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This  paper  presents  a  plan  for  FAA  development  of  a  method  to  establish 
aircraft  structural  inspection  programs  on  a  more  rational  scientific  basis. 

The  structure  of  a  commercial  air  transport  is  inspected  periodically  to 
detect  defects  or  damage  before  such  deficiencies  become  hazardous  and 
preferably  before  extensive  repair  is  required.  .Vhile  the  airl'.ie  safety  record 
is  considered  good  and  has  been  improving,  there  have  still  been  accidents 
and  incidents  in  recent  years  as  a  result  of  failures  from  defects  which  were 
not  detected.  Hazards  or  failure  causes  for  this  paper  are  classified  as  - 
fatigue  and  corrosion;  birth  defects  as  production  or  design  detects;  and  ser¬ 
vice  operational  or  maintenance  damage. 

Rational  development  requires  a  model  which  would  permit  a  priori  evalua¬ 
tion  of  the  effectiveness  of  an  inspection  program.  The  modeling  approach 
^selected  uses  computer  simulation  to  evaluate  a  relatively  complex  model 
covering  a  major  portion  of  the  primary  structure  of  the  airplane  and  account¬ 
ing  for  most  of  the  major  variables  of  service  usage  and  inspection.  Estimates 
of  the  benefits  and  cost  of  development  show  cost  of  development  and  application 
to  a  hypothetical  fleet  to  be$31.6,  000.  Benefits  were  predicted  as  changes  in  the 
present  accident  rates  and  inspection  intervals.  The  net  benefits  after  deduction 
of  increased  inspection  costs  are  estimated  to  be  equivalent  to  $.10,  000,  000  for 
the  hypothetical  fleet.  Tasks,  schedules,  and  reouired  manpower  are  defined. 
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background  and  definition  of  problem 


The  structure  of  a  commercial  air  transport  is  inspected  periodi¬ 
cally  to  detect  defects  or  damage  before  such  deficiencies  become  hazardous 
and  preferably  before  extensive  repair  is  required.  The  Federal  Aviation 
Administration  (FAA)  requires  that  the  inspection  be  performed  in  accordance 
with  an  acceptable  program.  Initial Ly,  this  inspection  program  is  usually 
developed  by  the  manufacturer  and  submitted  by  the  airline  to  the  FAA  for 
acceptance  and  will  specify  the  areas  to  be  inspected  and  the  frequency  and 
method  of  inspection.  The  initial  program  is  invariably  modified  as  service 
experience  is  accumulated.  Hie  inspection  is  intensified  in  areas  where 
service  problems'  occur  and  is  relaxed  where  none  occur. 


Toe  airline  airframe  maintenance  program  is  a  massive  and  expensive 
program.  TypiuaLly,  the  airlines  will  spend  as  much  on  airframe  maintenance 
during  the  20  year  life  of  the  airplane  as  the  airplane  initially  cose*-. 

This  means  that  for  the  U.  S.  airLir.o  fleet  of  2  to  3,000  aircraft,  costing 
on  the  order  of  $5,t'30,0F,)  c-uch,  that  $500,009,000  is  being  sp‘„nt  each  year 
on  airframe  m  linlensnce,  inclusive  of  downtime  costs.  It  is  th*»r«. fore 


*"Jet  Opera1  in;.»  Data  - 
September,  I'JoJ,  pp.  31-32. 


H-707  and  B-727."  Air  Transport  '->r!  i. 


important  that  this  program  be  optimized.  The  FAA  policy  statement*-  and 
prevailing  industry  opinion  would  indicate  that  an  "optimum"  program  would 
be  a  minimum  cost  program  in  which  accident  and  repair  costs  are  fully 
accounted  for.  In  general,  as  inspection  frequency  and/or  intensity  are 
increased,  thus  increasing  inspection  costs,  accident  and  repair  costs  are 
decreased,  and  vice  versa.  There  arc,  however,  as  discussed  below, 
indications  or  symptoms  that  present  programs  are  not  optimum. 

While  the  airline  safety  record  is  considered  good  and  has  been 

improving,  there  have  still  been  accidents  and  incidents  in  recent  years  as 

o 

a  result  of  failures  from  defects  which  were  not  detected".  A  707  was  torn 
apart  by  a  mountain  wave  over  Mt.  Fugi  in  Japan  in  1970.  The  initial 
failure  appeared  to  have  been  the  failure  of  the  vertical  tail  through  a 
pre-existing  fatigue  crack  which  had  reduced  the  original  strength  by 

A  720  was  lost  in  1971  in  a  training  accident.  An  engine  was  cut 
during  an  approach,  the  pilot  applied  hard  rudder  to  balance  the  airplane, 
the  rudder  actuator  broke  through  a  pre-existing  stress  corrosion  crack 
resulting  in  loss  of  control.  The  part  in  normal  service  was  not  leaded 
and  the  rudder  was  normally  not  needed  except  during  such  an  engine  out 
condition. 

*U.  S.  F ‘partnvnt  ot  Transportation,  Federal  Aviation  A {ministration. 
Policy  °t  it _ *•  ’  ■  1 1  '  i  C  ;  n  *  -  t'cder  lUOO.  I 

pp.  7-lj. 

^Gceut  Dritiin,  Civil  Aviation  '.sthority,  ’’^rld  Airl’c"  Acci-'  nt 
Snrmry,  (Cheltenham:  Technical  Publications  iVp irtmcnt) ,  p.  A /l. 


A  British  Vanguard  was  lost  in  1971  because  undetected  corrosion 
resulted  in  failure  of  the  aft  pressure  bulkhead  at  the  point  where  the 
control  cables  pass  through  resulting  in  fouling  of  control  cables. 

An  F-2?  wing  failure  occurred  in  1968  through  a  pre-existing 
fatigue  crack  which  appeared  in  x-rays  of  previous  inspections  but  was  not 
detected. 

A  large  hole  was  blown  out  of  the  side  of  a  DC-6  cabin  in  1967  due 
to  a  fatigue  crack  which  was  initially  detected  and  repaired  but  whose 
subsequent  growth  was  not  detected. 

A  large  hole  was  blown  out  of  the  side  of  a  707  cabin  in  1970 
because  of  a  large  undetected  fatigue  crack. 

A  DC-3  wing  failed  in  1968  because  of  a  large  undetected  fatigue 

crack. 


Two  British  Heralds  were  lost  in  1965  because  the  pressure  cabin 

failed  through  an  area  of  extensive  undetected  corrosion.  One  was  being 

used  to  transport  pilgrims  to  Mecca.  They  had  aboard  their  own  animal 

sacrifices  whose  wastes  enroute  contributed  to  the  corrosion. 

^  > 

* 

♦ 

The  above  accidents  and  incidents  indicate  the  potential  benefits 
frcm  reliable  defect  detection.  Detection  reliability  is  dependent  upon: 
(1)  the  inspectJbility  of  the  structure;  (2)  the  frequency  of  inspection; 
(3)  the  '£ fectiveness  of  the  inspection  method;  and  (A)  the  comprehensive¬ 
ness  of  the  inspection  program.  This  pap *r  will  deal  only  with  the  inspec¬ 
tion  program  and  not  the  design  of  the  airplane.  Consequently,  the  lirst 
factor  will  not  be  considered  directly. 
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While  the  above  may  seem  to  indicate  the  need  for  more  inspection, 
it  is  the  prevailing  opinion  of  the  operating  personnel  who  are  in  charge 
of  structural  inspection  that  much  inspection  is  unnecessary!.  This  opinion 
is  apparently  the  result  of  many  inspections  in  which  no  damage  or  only 
minor  damage  was  found.  Probably  as  a  result  of  this  view  and  with  little 
other  substantiating  basis,  inspection  intervals  have  been  steadily 
lengthening  and  the  inspection  sample  has  been  decreasing  over  the  years. 

For  example,  the  overhaul  interval  for  a  mature  DC-6  was  approximately  6,009 
hours  with  a  100%  sample  whereas  a  mature  727  has  a  18,000  hour  overhaul 
interval  with  a  20%  sample. 

The  present  inspection  programs  were  initially  developed  largely  by 
extrapolating  from  programs  on  past  airplanes  on  an  intuitive  basis.  While 
the  des’.gn  features  were  thoroughly  reviewed,  much  available  information  on 
the  .;as  net  u  zz.  Fur  the’*,  available  mathematical  technimips  for 

estimating  the  effectiveness  of  a  given  inspection  program  were  not  used. 
Specifically,  no  attempt  was  made  to  show  from  a  knowledge  of  the  likelihood 
of  a  defect  occurring,  its  rate  of  degradation  and  the  frequency  of  inspec¬ 
tion,  that  the  desired  safety  level  would  be  attained. 

Further  signs  that  the  existing  inspection  programs  are  not  optimum, 
especially  from  a  safety  standpoint,  are:  (1)  from  laboratory  tests  and 
service  experience  it  is  known  that  a  defect  can  develop  and  progress  to 
failure  in  Less  than  the  typical  inspection  period^;  (2)  the  frequency  of 

^Clarence  A.  Beil',  Principal  Federal  Aviation  Administration  Inspec¬ 
tor  for  Delta  Airlines,  Personal  Communication. 

^Memorandum  irom  Chid  of  Engineering  and  Manufacturing  Division  to 
Chief  of  Maintenance  Division  on  the  subject  ot  Structural  Mainter.ir.ee  Pro¬ 
grams,  Federal  Aviition  Administration,  Washington,  D.  C. ,  b  October  l‘)b-7. 


inspection  is  decreasing  on  new  models  while  at  the  same  time  the  structure 
is  being  "optimized"  by  eliminating  areas  of  extra  strength. 

The  above  symptoms  indicate  a  gap  between  the  present  and  "optimum" 
inspection  programs  and  indicate  that  perhaps  the  inspection  program  could 
be  optimized  by  using  all  available  analytical  techniques  to  estimate  its 
effectiveness  and  potential  trade-offs  for  improvement. 

A  logical  question  is  -  What  are  the  obstacles  or  causes  for  not 
using  such  an  approach?  The  first  reason  is  that  no  one  knows  how,  at 
least  on  a  practical  basis.  Further,  many  of  the  people  involved  do  not 
have  the  technical  training  for  such  a  task.  Such  technical  talent  is 
available  in  the  FAA  and  the  manufacturers  engineering  groups.  The  manufac¬ 
turers’,  however,  are  motivated  primarily  only  in  the  direction  of  lowering 
inspection  costs  as  they  must  bear  directly  only  the  "design  defect"  portion 
of  tile  ucciueut  COsus,  Consequently,  Cue  tusk  of  deVeiupiiig  ami  pruumdfrg 
the  broad  approach  falls  primarily  on  FAA  engineering,  and  this  paper  will 
address  the  problem  from  this  latter  viewpoint. 


DEVELOPMENT  OP  Mhl'.sOD  FOR  EVALUATING 
INSPECTION  IROGPJvM  EFFECTIVENESS 


Objectives  and  Obstacles 


The  effectiveness  of  a  structural  inspection  program  ii  judged  by 
the  degree  to  which  it  fulfills  its  purpose,  which  is  to  prev-.nt  accidents 
and  major  structural  repairs.  (The  cost  of  conducting  the  inspection 
program  is  a  separate  consideration).  Thus,  the  effectiveness  of  the  in¬ 
spection  program  can  be  quantified  by  estimating  the  probability  of 
major  structural  repairs  under  the  program.  In  the  past  there  hn.s  been  no 
at-LuapL  to  uj.Iu_L  of  auett  pt ouauiliLies .  uo.ioe'. ju:ili >  , 

effectiveness  of  tne  inspection  programs  could  be  evaluated  only  after  the 
fact..  The  rational  method  of  estinatir.g  these  probabilities  would  be  to 
build  a.  model  of  the  system  and  operate  the  model  using  appropriate  input 
data  on  the  airy  lane  ani  infection  program.  The  objective  this  -\v'e 
the  ptoj  at  v-’.i  ’.-/'To  :...ne  mis  .*io  estimate.;  'i  Lh>.  ■.  :-r  /  .  ; .  1 1  *  . ■  , 

thu.-  p  .•At.'.’  r.  .•  .eri  --llu  Uon  of  the  it. .jx.ct i«>j.  pr 


The  obstacles  to  reaching  this  objective  are  a  lack  of  input  data 


and  a  valid  model.  The  obstacles  to  obtaining  such  data  and  model  are 
primarily: 

1.  A  great  deal  of  hard-to-get-data  is  needed  to  define  the 
airplane  and  the  inspection  program  adequately. 

2.  The  "real"  system  is  extremely  complex  and  this  makes  it 
difficult  to  build  a  realistic  model  for  the  general  case. 

Possible  ways  of  overcoming  these  obstacles  are  discussed  in  the 
following  pages. 


Input  Data 

The  model  of  the  system  must  bo  at  least  partially  defined  before 
the  needed  input  data  can  be  identified.  A  scenario  for  such  a  model  in 
simple  terms  is: 

A  detectable  defect  occurs  thereby  degrading  structural  str  ngth; 
the  defect  either  grows  thus  progressively  reducing  the  strength, 
or  does  not  grow  until  either:  (l)  it  is  detected  and  repaired;  or 
(2)  a  load  in  excess  of  the  degraded  strength  ic  experienced  thus 
causing  failure;  or,  (3)  the  airplane  is  retired  from  service. 

Taking  a  lead  from  procedures  established  for  reliability  ana! ''sis 
of  electronics  '.y  slims*,  it  would  appear  that  the  general  procedure  ter 
solving  this  probl-M  would  as  follows: 

1.  Divide  structure  into  elements. 

2.  Determine  failure  (defect)  rates  for  each  element  for  each 
hazard. 


*Arlnc  oirvlt  f\  ir«o  i  i  <n,  r'  J 
N.  J. :  Prenttc'-il  1 1 1  Inc.,  1*6/ 1  pp. 
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3.  Determine  rate  of  strength  degradation  for  each  element  for  a 
•  defect  from  each  hazard. 

4.  Build  a  functional  model  of  the  entire  structure  in  terms  of 
these  elements  and  define  catastrophic  failure  or  major  repair 
in  terms  of  these  elements. 

5.  Determine  rate  of  occurrence  for  each  stress  level  for  each 
element. 

6.  Define  frequency  of  inspection  for  each  element. 

7.  Determine  reliability  of  the  inspection  (given  that  an  inspec¬ 
tion  is  made)  in  terms  of  degree  of  degradation. 

8.  Use  these  data,  the  functional  model,  and  probability  theory  and 
estimate  the  probability  of  catastrophic  failure  and  the 
probability  of  major  repairs. 

From  the  foregoing  initial  cut  at  describing  the  scenario  and  the 
procedures  for  solving  the  problem,  it  appears  that  the  following  input 
data  for  a  model  is  needed: 

1.  Failure  rates  for  each  element  for  each  hazard. 

2.  Rate  of  strength  degradation  for  each  element  for  each  hazard. 

3.  Rate  of  occurrence  for  each  load  level  of  each  element. 

i 

4.  Frequency  of  inspection  for  each  element, 

5.  Reliability  of  inspection  (given  that  an  inspection  is  cade)  in 
terms  of  degree  of  degradation. 


Division  of  Structure  Into  Elements 

Ideally,  the  structure  or  system  should  be  divided  into  elements  in 
such  a  way  that  the  structure  is  realistically  represented,  the  system  model 
Is  simplified,  and  the  elements  are  such  that  their  characteristics  such  as 
failure  rates  can  be  easily  defined.  Electronic  systems  are  quite  ideal  in 
this  respect.  The  elements  of  circuits  such  as  resistors,  capacitors, 
transistors,  etc.,  are  easily  identified  and  definable.  They  are  used  by 
the  million  and  because  of  this  extensive  service  experience  on  essentially 
identical  parts  under  essentially  the  same  environment,  their  failure  ratei 
can  be  rather  accurately  predicted.  Further,  failure  or  performance  of  the 
system  can  be  quite  accurately  defined  in  terms  of  complete  failure  of  each 
clement,  i.e.,  complete  tailure  of  most  any  tube  in  a  TV  set  will  disable 
the  set. 


The  above  situation  is,  to  a  lesser  extent,  also  true  on.  the  black 
box  level  of  electronic  systems.  However,  the  situation  with  aircraft 
structure  ia  not  so  simple.  The  elements  are  not  so  easily  identifiable 
war  are  they  repeated  exactly  from  model  to  model.  Further,,  because  of 
extensive  redundancy  and  because  the  load  imposed  is  not  constant  (as  is 
essentially  the  with  electronic  systems)  failure  cannot  bo  easily 

defined  in  terms  of  failure  of  each  part  nor  is  failure  of  one  part  indepen¬ 
dent  of  the  failure  of  an  adjacent  part. 

A  review  of  past  structural  inspection  programs  (DC-b,  rC-8,  707, 

7A*7!  airplanes)  indicates  that  typically  an  aircraft  ia  divided  into  worn 
iareas  or  zones.  Thu  structural  elements  within  each  zone  which  are  most 


likely  to  f3il  and/or  whose  failure  would  significantly  reduce  the  overall 
strength,  are  identified  and  singled  out  for  special  emphasis  in  inspection. 
Such  elements  are  customarily  called  "structurally  significant  items"  and 
the  inspection  program  is  defined  for  each  item.  The  manufacturers,  especial¬ 
ly  in  recent  years,  have  made  extensive  reviews  of  the  design,  design 
analysis,  tests,  and  service  experience  to  identify  such  elements.  A  great 
deal  of  additional  effort  was  expended  on  some  recant  airplanes  in  defining 
the  characteristics  of  each  item  in  order  to  rate  each  item  in  terms  of 
need  for  inspection.  This  inform,  -ion  was  presented  in  inspection  rating 
sheets  such  as  shown  in  Sheet  2  of  Figure  1,  which  were  developed  in  accord¬ 
ance  with  criteria  shown  in  Sheet  1  of  Figure  1.  It  is  anticipated  that 
such  information  will  be  available  on  major  aircraft  programs  in  the  future. 

It  is  evident  that  manpower  constraints  on  the  project  do  not  permit 
generation  of  new  information  in  this  area  and  that  existing  information 
will  have  to  be  used.  Accordingly,  the  structure  should  be  divided  into 
elements  which  are  based  on  "structurally  significant  items".  It  would  be 
Ideal  if  complete  failure  of  any  given  element  could  be  considered  catas¬ 
trophic  as  it  would  result  in  a  simple  chain  model  or  series  model.  This 
could  be  accomplished  by  defining  the  failure  model  or  path  for  each  signi¬ 
ficant  structural  •'.'icnenC  for  each  hazard  and  by  including  in  the  element 
all  adjacent  structure  in  this  path  whose  failure  would  assure  failure  under 
the  load  equal!'!  >'r  ex-.e_  toj  each  flight.  Thus,  the  failure  of  any  elc  *nc 
could  be  censiicr.i  to  likely  be  catastrophic  out  some  elements  woul  i  consirt 


EXPLANATION  OF  STRUCTURES  ANALYSIS  METHOD 
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of  mo*e  Chan  one  structurally  sign  if leant  items  and  failuro  of  one  element 
could  influence  the  failure  of  another  element. 


Hazards 

In  order  to  define  the  Input  data  for  each  element  for  each  hazard, 
at  least  the  primary  hazards  must  be  defined.  A  brief  Douglas  Aircraft 
study  on  inspection  programs.3,  categorizes  the  structural  hazards  as  fatigue, 
preload,  and  corrosion.  An  airline  study  of  structural  problems2  classifies 
structural  problems  a9  corrosion,  material,  or  fastener  discrepancies. 
Jensen,  Chief  Engineer  of  Sikoshy  Aircraft'3,  indicates  that  structural 
reliability  Is  a  function  of  variability  in  design,  production,  operation, 
and  maintenance. 


For  the  purposes  of  this  paper,  the  hazards  or  failure  causes  vlll 
be  classified  as  -  fatigue  and  corrosion  which  are  wear-out  and  aging 
phenomena ;  birth  defects  such  as  production  or  design  defects;  and  service 
operational  or  maintenance  damage  which  Intuitively  would  seem  to  be  random 
with  time.  There  is  of  course,  the  additional  hazard  of  complete  failure 
due  to  overload  but  as  this  type  of  failure  cannot  be  prevented  by  a 


structural  inspection,  it  is  not  gennaine  to  this  paper. 
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Ail  defects  detected  in  service  are  noted  and  to  the  extent  recorded, 
their  frequency  and  description  can  be  determined  from  service  records. 
Service  records  may  not  state  the  cause  of  the  defect,  although  an  educated 
•mbs  can  many  times  be  made  from  the  description  of  the  defect  and  cir- 
caca faces.  If  the  manufacturer  has  Issued  corrective  action  in  the  form 
•f  s  service  bulletin,  the  cause  of  the  defect  may  be  obtained  from  the 
Service  bulletin  as  the  airlines  require  that  it  include  a  statement  of  the 
ssnse  .  A  brief  description  of  each  hazard  follows. 

fhtlsue 

Ibis  Is  a  major  hazard  and  failure  mode  which  results  from  repeated 
eperetlooat  loads  causing  a  crack  to  initiate  at  a  high  stress  point  (such 
ss  censed  by  s  hole,  gauge,  sharp  radius,  corrosion  pit,  etc.)  and  grow  at 
S  progressively  faster  rate  until  complete  failure  occurs.  As  the  cumulative 
■after  of  repeated  loads  increases  with  flight  time,  the  probability  of 
fatigue  defects  increases  with  time.  The  resistance  of  a  normal  structural 
element  to  fatigue  cracks  varies  widely  between  apparently  identical  elements 
aed  the  severity  of  the  repeated  loads  varies  widely  between  identical 
aircraft.  Consequently,  fatigue  cracking  is  a  probabilistic  phenomenon 

cad  cannot  ba  ruled  out  even  when  the  structure  is  manufactured,  operated, 

* 

Cad  maintained  as  specified.  The  probability  of  cracking  under  the  above 
conditions,  which  will  be  called  "classical  fatigue",  can  be 
predicted  from  a  knowledge  of  design  characteristics  and  the  operating 
eavironTont.  However,  fatigue  cracking  under  off-design  conditions,  such 


••  Initiated  by  production,  maintenance  or  operational  errors,  cannot  be 
predicted  directly  from  design  conditions. 


Corrosion 

This  is  also  a  major  hazard  and  failure  made  and  occurs  in  different 
£uu  such  as  surface  corrosion,  intergranular  corrosion,  and  stress 
corrosion^-.  The  susceptibility  to  corrosion  varies  for  different  portions 
of  the  structure  depending  on  the  corrosion  resistance  of  the  material  used, 
tike  efficacy  of  the  corrosion  protection  provided,  and  the  severity  of  the 
eonrirohment.  Corrosion  is  a  progressive  failure  mode.  In  the  opinion  of 
experienced  aircraft  maintenance  personnel  ,  the  probability  of  co-rosion 
increases  with  time,  in  spite  of  the  learning  curve  on  a  given  model. 
Corrosion  alone  can  grow  to  complete  failure,  however,  it  can  be  initiated 
by  birth  defects  or  service  damage  which  can  degrade  the  protection,  lower 
tbft  resistance  of  the  material,  or  increase  the  severity  of  the  environment. 
Iks  probability  of  a  corrosion  defect  cannot  be  directly  predicted  from 
design  characteristics  except  where  drastic  measures  are  taken  to  completely 
eliminate  a  past  problem.  Due  to  normal  design  improvements,  the  probabili¬ 
ty  of  corrosion  can  be  conservatively  predicted  from.  service  experience  on 
past  models. 

* 

girth  Defects 

"Birth"  defects  can  bo  caused  by  production  errors  or  design  errors. 
Production  errors  such  as  gouges,  improper  radii,  surface  finish,  corrosion 
protection,  and  heat  treat  are  of  interest.  Design  errors  can  include 

^British  Aircraft  Corporation  Ltd.,  Vfsconnc  B00/S1 0 *5orios  \ircnft 
ffan'nt,  15  An",.  L%7.  (Keybridce,  Englind:  British  Aircraft  Corporation  Led. 
1967),  pp.  2.12,1  -  2.12.6. 

2 

Clarence  A.  Beale,  Principal  Federal  Aeiation  Administration  Inspec¬ 
tor  for  Delta  Airlines,  Personal  Communication. 


R*produc«d  from 
bast  available  copy. 


•rrors  such  as  under-estimating  loads,  neglecting  to  stress  check  a  critical 
jirea,  or  to  specify  corrosion  protection  where  protection  was  intended. 

Errors  can  also  be  made  in  designing  repairs  and  production  modifications. 

(By  the  definition  given,  classical  fatigue  design  fatigue  errors  would  be 
included  under  the  fatigue  hazard.)  Birth  defects  are  essentially  one-time 
occurrences  and  do  not  result  in  progressive  failure  except  through  the 
action  of  the  fatigue  or  corrosion  phenomena  which  they  may  initiate.  A 
Survey  of  the  type  certification  records  of  major  transports  shows  that  all 
have  been  designed  under  the  fall  safe  structure  design  standards  which 
require  extensive  structural  redundancy.  Consequently,  with  the  stringent 
design  and  production  quality  control  standards  in  effect,  it  is  extremely 
unlikely  that  birth  defects,  which  would  be  detected  by  a  service  inspection 
program,  would  affect  enough  of  the  redundant  members  to  result  in  a  complete 
failure  in  service.  Such  defects  could  result  in  complete  service  failures 


only  LtiruUfcli  Initialing  uuu  u£  the  tWw  basic  progressive  failure  mechanisms 


of  fatigue  or  corrosion. 


Service  Drmage 

Service  damage  includes  operational  damage  such  as  tearing  skin  with 
s  fork  life;;  spillage  of  waste  and  other  corrosive  substances;  and  mainten- 
snee  damage  such  as  damaging  parts  during  disassembly  or  assembly,  tearing 
fuselage  insulation  blankets  resulting  in  moisture  collection  and  corrosion. 
It  seems  reasonable  that  such  service  damage  is  random  with  time.  As  is  the 
case  with  birth  defects,  detectable  service  damage  Involves  essentially  one¬ 
time  occurrences  and  could  result  in  complete  failure  only  through  initia¬ 
ting  the  bisic  progressive  failure  mechanism  of  fatigue  or  corrosion.  There 

* 

would  appear  to  be  no  way  of  predicting  the  probability  of  either  service 


4mm  ge  or  birth  defects  directly  froo  a  knowledge  of  design  characteristics, 
however,  past  service  experience  may  provide  a  basis  for  such  a  prediction. 


Selection  and  Definition  of  Data  Sources 

There  are  only  three  passible  basic  sources  for  input  data  for  this 
problem  -  technical  analysis.  Laboratory  tests,  and  service  experience.  As 
aircraft  development  programs  are  massive  programs  and  airline  experience 
It  extensive,  it  would  seem  that  these  sources  should  be  adequate.  However, 
much  of  the  information  developed,  was  mat  recorded  or  is  not  available.  In 
tome  cases  the  only  method  of  drawing;  an  this  background  of  information 
mould  be  by  obtaining  multiple  opinions  af  experts  in  the  field. 

4*  Indicated  by  Stone  ,  technicall  analysis  for  atxucture  consists 
primarily  of  stress  analysis  of  batih  damaged;  and  undamaged  structure  to 
ittermine-  failing  strength,  under  an®  tttin®  Hoads-  and  of  fatigue  analysis  to 
tobeouine-  time  to  Initial  crack  on  time  tau  final  failure  under  repeated 
loads s  laboratory  tests  to  determines  trite  same  information  are  performed 
ik  lieu  of  or  to  validate  these  analysis..  Repeated  load  tests  will  show 
tbe  cate  of  strength,  degradation,  undkir  repeated,  loads  after  a  detectable 
exack  or  defect.,  Also  cotrosioir.  testes  under  a  severe  corrosion  environment 
Kill  indicate  the  resistance  off  vaniirus  metals'  and  finishes  to  resist 
Ctttroslon.  The  design  character.latdits  as  defined  by  these  tests  and  analy- 
CCS  and  by  a.  design  review  ace  normally  summarized  in  the  inspection 
criticality  rating  sheets  such  as-  figure  IL. 
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There  are  four  basic  sources  of  information  on  service  defects  - 
IRA  mechanical  reliability  reports  (MRR'3),.  National  Transportation  Safety 
Board  (NTSB)  accident  records,  airline  maintenance  records',,  and  the  manu¬ 
facturers  records  of  service  problems.  The  airline  is  required  by  law  to 
mafia! t  PlRFL's  to  the  FAA  on  all  structural  cracks r  corrosion,,  and  deformation 
abfcK  are  beyond  acceptable  limits.  These  reports  have  been  categorized 
aad  retained,  since  1962  and  are  readily  available..  They  can  be  retrieved 

tj  computer  for  the  last  two  years  and  manually  for  the  previous  years. 

r  7 

Mscussious  with  knowledgeable  airline  personnel  indicate  *’  that  the  air¬ 
line-  retain;  service  defect  records  only  as  long  as  legally  required  (approxi¬ 
mately  twor years)  and  because  there  is  no  system  common  ta  all  airlines, 
eettrieva L  of  information  would  be  a  monumental  task..  Consequently,.  airline 
iccarda  can  be  eliminated  as  a  useful  source. 

W5Hi  structural  accident  records  are  readily  available  for  all 
years  af  interest..  As  these  accidents  are  thoroughly  investigated,,  the 
cense  and  details  on  the  structural  descrepancies  are  usually  known..  There 
ase  only  a  snail  number  of  such  accidents  so  these  records  would  be  of 
little-  use  for  determining  structural  descrepancy  rates  but  may  give  a  good 
insight  ta  actual  failure  modes  and  circumstances  for  catastrophic  failures. 

%dward  h.  Thomas-,  Director  of  Engineering,  Air  Transport  Association 
of  America,.  Personal  Communication. 
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It  is  airline  practice*-  to  report  failures  and  to  send  failed  parts 
to  manufacturers  so  that  they  can  determine  causes  and  fixes.  As  there  are 
only  two  major  U.  S.  manufacturers  for  transports  of  recent  vintage,  these 
records  are  relatively  concentrated.  Also,  in  the  last  two  years  (e.g. , 
Boeing  747)  a  real  effort  has  been  made  to  assemble  such  information  into  a 
readily  accessible  data  bank.  The  manufacturers  records  are  likely  to  pro¬ 
vide  a  better  definition  of  failure  causes  than  the  MRR's  because  of  the 
failure  investigation  but  have  the  disadvantage  that  they  are  generally  not 
automated  and  are  not  readily  available  to  the  FAA  because  of  their  pro¬ 
prietary  nature  and  the  cost  the  manufacturer  would  incur  in  making  them 
available.  However,  manufacturers  do  issue  service  bulletins  outlining 
"fixes"  for  significant  structural  problems  and  at  the  airlines  request, 
these  bulletins  identify  the  cause  of  the  problem.  These  service  bulletins 
are  submitted  to  the  FAA  for  approval  and  are  therefore  available.  It 
would  appear  t'nac  cne  manufacturers  records  cirectly  or  through  service 
bulletins  would* be  a  good  source  for  identifying  the  cause  of  the  defects 
for  which  the  MRR's  are  not  adequately  definitive.  At  least  one  manufac¬ 
turer  .has  indicated  that  he  would  provide  information  if  formally  requested 
and  the  workload  was  not  excess ive^. 

The  above  discussion  provides  a  general  basis  for  the  following 
detailed  definition  and  selection  of  data  sources  for  input  data  for  the 
individual  system  variables. 

*Henry  J.  Young,  "Aircraft  Structure  Reliability  Programs," 
Proceedings  01  r<\  "  » inten  iree  '!■■■  no:j"m  (Washington,  D.  C.:  Federal 
Aviation  Administration,  l'.'obj,  p.  5. 

^Richard  Hr  inert.  Assistant  Airworthiness  Manager  707/727/737,  Hie 
Boeing  Co.,  Personal.  Communication. 
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As  previously  discussed  under  hazards,,  it  cannot  necessarily  be 
assumed  that  the  rate  of  occurrence  of  a  given,  type  of  defect  remains  con¬ 
stant  throughout  an  airplane's  service  life.  Same  hazards,,  such  as  fatigue 
sod  corrosion,,  increase  with  time  in  service  while  other  hazards,  such  as 
service  damage  and  birth  defects,  tend  to  decrease  with,  time  in  service  or 
remain  constant.  A.  survey  of  the  MRR's  on  a  given  jet  model  for  the  period 
•t  1962  to  1972  is  summarized  in  Figure  2  and  confirms  the  above  trends. 

Iha  data  sources  for  the  defect  rates  and  their  vaxxar.tioir  with  time  for  the 
various  hazards  are  discussed  below. 

Classical  Fatigue  Defect  Rate 

Karins  the  design  and  certification  at  eccfli  major-  new  model,  the 

vefttk  fatigue  life-  of  each,  significant  structural!  adJaraerrt:  £se  determined  by 

fefcfxue  test  and/or  analysis  for  the  evpertprf'  sn’nrmmr  nF  rppeafpri  loaHji 

0&  recent  models,  this  information-,  has  heerr.  avadiHatrlle?  tar  the  FAA  in  the 

documentation  justifying  the  proposed  inspection,  program-..  With  this 

taformation  on  the  design  and.  the  information.  freon  Chts  lxterature  on  the 

variation  of  fatigue  life  and  Loading  spectra-  between:  individual  airplanes, 

it  is.  possible  by  thp  method  described  by  Anderjhaka?  tzx-  estimate  the 
» 

probability  of  fatigue  cracking  as  a.  function  or  tdtie  mirnher  of  flights  or 
flight  hours  completed.  Use  of  this  method  wouLd  conuLt- in  a  rate  that  in¬ 
creases  with  the  flight  time  on  the  aircraft. 


%tone,,  "Developing  the  DC-10  Inspection  Program.,"  pp.  4-5. 

^Arnold  E.  Anderjaski,  Fiti-ue  Funst-i^ti  it jryr  r|r-~cd,irc>^  for 
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Figure  2 

Typical  Defect  Rate  Trends 


FATIGUE  RATE 


Vf 2k  9NId303H<I  NI  I3VH0HIV  H3H 
SID333 a  39V;*7a  30IAH3S  HO  NOISOHHOD 


M  •“< 

•  • 


HV3A  0MIU30aad  HI 

ijwou iv  H3d  sioajaa  anouvj 


YEARS  SINCE  INTRODUCTION 
INTO  SERVICE 


If  the  probability  estimates  are  based  on  a  fatigue  life  determined 
by  fatigue-analysis  in  lieu  of  test,  the  possible  errors  of  the  fatigue 
analysis  would  have  to  be  accounted  for  as  fatigue  analysis  is  notoriously 
inaccurate.  This  lack  of  reliability  was  documented  in  an  extensive  study 
of  the  subject  by  the  Royal  Aeronautical  Establishment^.  The  probability 
of  the  fatigue  analysis  under-estimating  or  over-estimating  the  true  mean 
life  by  a  given  amount  could  be  estimated  by  the  results  given  in  the  above 
study  and  a  correction  made  on  a  probabilistic  basis. 

The  classical  fatigue  defect  rate  could  be  estimated  from  service 
experience  but  except  for  early  problem  areas,  the  rate  could  not  be  estab¬ 
lished  until  late  in  the  life  of  the  fleet.  With  this  approach,  the  inspec¬ 
tion  for  a  given  problem  area  could  not  be  established  until  after  the  fact 

2 

unless  based  on  the  experience  of  previous  models.  Fatigue  tests  show 
that  minor  design  changes  can  result  in  large  changes  in  mean  fatigue  life 
and  the  probability  of  a  fatigue  defect  varies  drastically  with  mean  fatigue 
life^.  As  most  new  models  have  an  improved  fatigue  design,  use  of  service 
experience  on  past  models  have  an  improved  'atigue  design,  use  of  service 
experience  on  past  models  to  predict  the  capability  of  new  models  would  be 
unrealistic.  For  these  reasons,  it  is  concluded  that  prediction  of  the 
classical  fatigue  defect  rate  directly  from  design  characteristics  would  be 
more  effective. 

^K.  D.  IWthbv,  A  Co-'Virison  of  Pr^dic  ti~*d  and  Achi.n'M  l-v-rs 

of  Aircraft  5 1 -j illllil— Lt  IVchricai  -V'J-  Structures  3 0 L ,  (rurnooroug.i, 

England:  Royai  Aircraft  Estaolishnent,  i9bl). 

^Stone,  lfDove Loping  the  DC-10  Inspection  Program,"  Fig.  3. 

^Ander  j.”  ika,  Fiti-yt-:  Suhstnnti  if  ion  Procedures. 
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Non-Classical  Fatieue  Defect  Occurrence  Rate 

This  category  of  defect  involves  fatigue  cracks  which  initiate  as  a 
result  of  ocher  hazards  such  as  birth  defects,  service  damage  and  corrosion. 
Notes  for  this  type  of  defect  can  be  established  for  a  given  type  of 
element  on  past  models  for  the  period  subsequent  to  1962  by  reviewing  the 
MRR's  to  determine  the  number  and  nature  of  defects  and  by  referring  to  the 
manufacturers  service  bulletins  and  records,  as  necessary,  to  identify  the 
cause  of  the  defect.  These  rates  would  apply  to  similar  new  models  except 
in  cases  where  a  design  change  has  been  nude  to  a  new  model  to  eliminate  a 
particular  type  of  initiating  hazard.  In  these  cases,  the  rate  could  be 
reduced  by  eliminating  appropriate  service  defect  reports  from  the  rate 
calculation.  As  there  have  been  no  analytical  techniques  developed  to  pre¬ 
dict  this  category  of  defect  directly  from  design  characteristics,  use  of 
•entice  experience  is  the  only  available  alternative.  The  design  character¬ 
istics  as  defined  in  the  manufacturers  inspection:  criticality  rating 
•oalysis  can  be  used  to  categorise  elements  according  to  their  susceptibility 
to  the  hazard  of  corrosion. 

Corrosion..  Birth,  and  Service  Damage  Defect  Gtocurrrnce  Rate 

Udder  the  approach  described  above*  airly  corrosion,  birth,  and 
* 

service  damage  defects  which  had  initiated  fatigue,  cracks  at  the  time  of 
detection  in  service  would  be  considered  Line. rlcu L'a ting  the  non-classical 
fatigue  defect  occurrence  rate.  Consequerrcihv,,  such  defects  which  wore 
reported  in  service  but  had  nut  yet  initialed.’  fatigue  cracks  at  the  time 
«£  detection  (e.g.  *  loose  fasteners)  must  thr>  amounted  for  separately. 

Such,  defects  could  eventually  cause  fatigue  tracks  and  thus  effectively 
tower  the  mean  fitigue  life. 
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The  effect  of  the  most  common  and  significant  types  of  these  defects 
(e.g. »  fretting  resulting  from  loose  fasteners,  corrosion  pitting,  rough 
surface  finish,  etc.)  on  si^an  fatigue  life  can  be  obtained  from  fatigue 
research  reports^-^, 3*4^6, .  if  the  defects  occur  in  a  high  stress  area, 
such  as  a  rivet  hole,  the  effect  on  mean  fatigue  life  would  correspondingly 
he  greater.  This  type  of  defect  could  be  accounted  for  by  estimating  the 
rate  for  each  element  from  service  experience  and  by  estimating  its  effect 
so  the  mean  fatigue  life  of  the  element. 

Corrosion  Defect  Occurrence  Rate 

Corrosion  is  a  progressive  failure  mode  which  can  result  in  complete 
failure  without  initiating  a  fatigue  crack,  especially  if  the  corrosion 
unrirunment  is  severe.  Thus  corrosion  involves  an  additional  hazard  to  the 
hazard  of  initiating  a  fatigue  crack.  The  rate  for  occurrence  of  defects 
due  to  this;  additional  hazard  can  be  estimated  from  service  experience  as  in 
the  previous  paragraph,  but  should  be  categorized  in  terms  of  severity  of  the 
corrosion  environment.. 
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£atc_  of  Strength  Degradation 


The  occurrence  of  a  detectable  defect  causes  little  reduction  of 
strength  in  a  typical  transport  structure  because  of  its  extensive  redun¬ 
dancy  and  tolerance  for  damage.  Such  a  defect  must  grow  in  size  to  cause  a 
significant  reduction  in  strength.  As  previously  mentioned  there  are  two 
basic  mechanisms  of  growth,  fatigue  or  corrosion  or  a  combination  of  the 
two.  The  data  sources  for  rates  of  strength  degradation  under  these 
nechanisms  are  discussed  below. 

Rate  of  Strength  Degradation  Due  to  Fatigue 

Aa  previously  mentioned,  for  recent  major  transports,  the  manufac¬ 
turers  have  rated  the  inspection  criticality  of  each  structurally  signifi¬ 
cant  item  in  terms  of  major  variables.  As  shown  by  Hardrath1,  two  of  these 
variables,  material  crack  propagation  resistance  and  the  degree  of  redun¬ 
dancy  in  construction  are  the  major  variables  in  determining  the  rate  of 
degradation  due  to  fatigue.  Consequently,  these  ratings  provide  a  good 
method  of  categorizing  the  various  structural  significant  items.  The  rate 
of  degradation  can  then  be  determined  for  each  category  from  the  usual 
~  ^development  tests  of  structure  under  repeated  loads  such  as  shown  in  Figure 
3  for  the  DC- 10^.  It  is  understood  that  the  degree  of  redundancy  rating  has 
been  based  on  the  safety  margins  shown  in  the  proof  of  strength  with  obvious 
damage  that  is  required’  by  FAA  regulations^. 
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Figure  3 


Tjryical  Crack  Propagation  Test  Result 
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Service  reports  can  also  provide  information  on  the  rate  of  degrada¬ 
tion.  Service  reports  many  times  give  the  size  of  defect  detected  and  the 
tine  since  the  last,  presumably  negative,  inspection.  From  this  information, 

the  rate  of  growth  can  be  deduced.  Also,  in  some  cases  a  detailed  metailur- 

« 

(leal  exam  of  the  failure*  is  made  under  high  magnificantion.  and  the  crack 
growth  rate  can  be  conclusively  established.  While  this  service  information 
is  directly  applicable  to  the  structure  in  service  and  is  of  limited  use  on 
MV  supposedly  improved  models,  well  documented  cases  could  be  used  as  a 
check  on  the  rate  of  degradation  as  determined  from.  laboratory  tests  on 
similar  structure  on  new  models. 

late  of  Strength  Degradation  Due  to  Corrosion 

In  the  inspection  criticality  rating,  each  structurally  significant 
item  is  rated  in  terms  of  resistance  to  corrosion  taking  into  consideration 
both  exposure ,  protection  and  basic  resistance  of  the  material..  These 
factors  are  the  major  variables  both  for  time  to  initiate  and  time  for 
growth  of  corrosion,  defects.  The  resistance  of  the  structure  or  the  severity 
«£  th.c  corrosion  environment  can  be  affected  by  birth  defects  or  service 
damage  which  are  noc  anticipated  in  the  rating.  The  severity  of  the  situa¬ 
tion;  is  indicated  by  the  time  required  to  initiate  corrosion. 

A$  indicated  under  rate  of  occurrence  of  corrosion  defects,  little 
realistic  information  on  corrosion  performance  is  available  from  laboratory 
tests  and  therefore  service  experience  is  the  primary  data  source.  As 
explained  unset  rate  of  degradation  for  fatigue,  the  rate  of  degradation  for 

*Royal  Aircraft  Establishment,  A  Motal  1  'T^ica  1  r*:  ant  nation  oP 
Of  Fr-M  gbt  P>.-r  tn . :  !r  iiv-  .  .-r  '.ii . •  i 

(Incident  -  da  s.  nt.,  [•;■))  (iarnboiougli,  EngLand,  Royal  Aircraft  Establish¬ 
ment,.  L'»70). 


corrosion  could  be  estimated  from  service  reports  of  corrosion  for  structure 
similar  to  each  "structurally  significant  item".  It  v^uld  appear  that  the 
rate  of  degradation  could  be  expressed  as  a  function  of  corrosion  resistance 
rating,  which  is  primarily  a  function  of  material,  location  and  time  to 
Initiate  corrosion.  Well  documented  cases  of  service  corrosion  could  be 
used  to  define  the  functional  relationship. 

Rate  of  Load  Occurrence 

In  order  to  estimate  the  probability  of  a  degraded  structure  failing 
due  to  the  occurrence  of  a  load  in  excess  of  its  strength,  the  rate  of 
occurrence  must  be  known  for  loads  of  various  magnitude  for  each  element. 

For  airplane  structure,  these  loadings  primarily  result  from  gusts,  maneuvers, 
and  cabin  pressurizations.  Fortunately  much  work  has  been  done  In  this 
area.  NASA  has,  for  many  years,  conducted  a  program  on  transports  of 
measuring  accelerations  at  the  airplane  center  of  gravity  (C.G.)  caused  by 
gusts  and  maneuvers.  The  speed,  weight,  and  altitude  associated  with  each 
acceleration  occurrence  are  also  measured.  The  rate  of  equalling  or  exceed¬ 
ing  each  magnitude  of  C, G. acceleration  can  be  estimated  for  new  transports 
from  these  data  on  past  transport  such  as  illustrated  by  the  curves  of 
Figure  4  which  are  conventionally  called  a  "loading  spectra".  However,  the 
load  on  an  individual  element  (except  pressurization  loads)  varies  not  only 
with  C.G.  acceleration  but  also  with  airplane  speed,  altitude,  '•.•■•ight,  and 
C.G.  position.  Derivation  of  the  element  loads  from  this  basic  lata  is 
very  involved  and  beyond  the  scope  of  the  project.  However,  such  element 
loads  are  normally  derived  by  the  manufacturer  during  his  fatijue  analysis 
program.  The  detailed  analysis  is  not  directly  available  to  the  FAA  as  a 


*» 


fatigue  analysis  is  not  required  by  the  FAA  for  fail  safe  structures  and  the 
manufacturers  have  been  reluctant  in  the  past  to  furnish  the  FAA  with  copies 
of  these  analyses.  Furthermore,  as  Larsen^-  indicates,  the  fatigue  analysis 
la  usually  computerized  with  the  derivation  of  the  element  loading  spectrum 
ftn  intermediate  step  to  obtaining  the  final  output  which  is  the  mean  fatigue 
life  of  the  element.  As  a  result  the  loading  spectrum  for  each  element  is 
not  directly  available  from  the  computerized  fatigue  analysis.  In  view  of 
the  resource  constraints  on  this  program  it  would  not  be  feasible  for  the 
FAA  to  obtain  element  loading  spectra  from  this  analysis. 

Lockheed  and  Boeing,  under  a  $250,000  FAA  contract,  have  calculated 
the  gust  loading  spectra  for  major  components,  such  as  the  wing,  fuselage, 
ftnd  tail,  for  several  typical  jet  and  piston  aircraft  .  These  spectra  were 
expressed  in  terms  of  a  ratio  to  design  limit  load  and  are  illustrated  in 
Figure  5  (FAA  regulations  require  that  the  structure  be  capable  of  support¬ 
ing  design  Limit  load  without  detrimental  deformation  and  150  percent  of 
limit  load  without  failure).  Design  limit  load  as  shown  in  this  work  is 
roughly  the  maximum  load  an  average  airplane  will  experience  in  its  lifetime 
A s  limit  load  on  an  element  is  defined  as  the  most  critical  combination  of 
BvG.  acceleration,  speed,  altitude,  and  ccnter-of-gravity  position  within 
the  design  envelope it  will  occur  much  less  frequently  than  indicated  for 
the  design  maximum  center-oi'--ravity  acceleration  in  Figure  A. 
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Figure  4 


Typical  Airplane  Loading  Spectra 


(Reference-Trends  in  Repeated  Loads 
On  Transport  Airplanes,  NASA,  Langley) 
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If  it  is  assumed  that  the  loading  spectra  derived  in  tk.e  above  st..i./ 
are  reasonable  for  the  major  components  of  new  models,  the  locoing  spectra 
for  individual  elements  of  the  major  components  can  be  estimated  by  adjust¬ 
ing  the  loading  spectra  to  account  for  any  excess  strength  present  in  each 
element.  For  example,  if  an  element  was  capable  of  supporting  300  perc..,: 
of  design  limit  load  without  failure  in  lieu  of  the  150  percent  required, 
then  design  limit  load  would  occur  at  the  same  frequency  as  indicated  for 
the  150/300  or  50  percent  of  design  limit  load  in  the  above  study.  As  it  is 
difficult  to  design  a  structure  with  exactly  the  required  strength,  there  is 
usually  some  excess  strength  available. 


The  above  assumption  is  not  unreasonable  because  current  new  models 

(except  for  the  supersonic  transport)  are  flying  at  the  same  speeds  and 

altitudes,  are  of  similar  construction  and  used  similar  design  practices  as 

past  models.  Further  HASA  data  shows  that  for  typical  jet  transports,  the 

loads  resulting  from  maneuvers  are  insignificant  compared  to  those  resulting 

from  gusts.  So  the  above  study  is  considered  a  reasonable  first  scarce  of 

input  data  for  rate  of  load  occurrence  tor  gusts  and  maneuvers.  Use  of 

loading  spectra  from  the  manufacturers'  fatigue  analysis  may  be  feasible  at 

a  later  date  should  Che  manufacturers  indicate  they  would  provide  the  londirg 

s' 

spectra  at  no  ch',rj;  or  should  additional  money  become  avail  rbl»>  for 
contracting  the  manufacturers  Co  provide  this  data.  Pressur iz itiori  loads 
occur  oneo  per  flij.it  and  are  defined  in  terms  of  cruising  altitude.  The 
frequency  of  occurrence  of  tha  •viriovs  cruisinn  altitudes  c:n  be  eustlv 
obtained  from  :i\S\  d.,tn  on  tr  ins  porta. 


1) 


cruisinn  altitudes  c 


Figure  5 


Typical  Variation  of  Load  Level 
With  Frequency  of  Exceedance 


(Reference-Development  of  a  Pox;er-Spectral  Gust 
Design  Procedure  for  Civil  Aircraft,  FAA,  Washington) 
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Inspection  Reliability 

The  probability  of  detecting  a  defect  during  a  scheduled  inspection 
depends  upon  how  well  the  inspection  is  performed  and  on  how  obvious  the 
defect  is  during  the  inspection.  The  latter  variable  depends  on  the  size 
and  type  of  defect  and  on  other  factors  such  as  whether  the  defect  causes  a 
fuel  leak  or  whether  adjacent  structure  holds  the  crack  closed. 

There  are  no  analytical  techniques  for  directly  predicting  the  pro¬ 
bability  of  detection  of  a  given  defect  during  an  inspection  and  a  review  of 
the  literature  does  not  reveal  any  significant  laboratory  studies  on  the 
subject.  During  some  laboratory  fatigue  tests*  it  has  been  noted  that  cracks 
of  a  certain  size  are  discernible  by  certain  techniques.  Further,  during 
most  such  tests,  each  crack  detected  is  reported  along  with  its  size,  loca¬ 
tion,  and  the  method  of  inspection.  However,  this  same  information  along 
with  the  time  since  last  inspection  is  given  in  Mechanical  Reliability  Re¬ 
ports  on  service  aircraft.  A3  service  data  is  extensive  and  is  much  more 
% 

realistic  than  that  from  laboratory  inspection,  it  is  the  best  source  of 
data.  The  problem  with  such  data  is  that  while  it  indicates  the  size  and 
type  of  defect  that  can  be  detected,  it  does  not  report  cracks  that  were 
missed  in  inspection.  Such  information  could  be  deduced  from  a  knowledge  of 
crack  growth  rates  and  the  time  since  the  last  inspection  but  it  would  be  a 
monumental  task  beyond  the  resources  available  for  this  project.  Further,  as 
little  crack  growth  data  has  been  available  for  past  models,  it  would  be 

*J.  Schijvc,  't  1 1 .  I- at*  mio  Tg  1 2  "ifh  HtI-'"  tv!  .>  -d  f  -nd 
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highly  Inaccurate.  It  would  be  possible  to  determine  the  size  of  the  missed 
defect  for- a  few  well  documented  cases  where  crack  growth  data  was  readily 
available  either  from  laboratory  tests  or  an  examination  of  the  fracture. 

For  example,  in  one  case  of  an  in-flight  decompression,  the  fracture  surface 
was  examined  under  high  magnification^-  and  the  number  of  loading  cycles  (in 
this  case  pressurization  cycles,  once  per  flight)  were  counted  back  to  the 
last  Inspection  thus  accurately  establishing  the  size  of  the  crack  missed  in 
the  last  inspection.  The  probability  of  detection  could  not  be  established 
from  these  few  cases  but  they  could  be  used  as  a  guide. 

Estimating  the  probability  of  detection  of  a  defect  during  inspec¬ 
tion  is  a  very  subjective  matter  which  is  difficult  to  judge  directly  from 
a  few  completely  defined  cases  and  many  relatively  undefined  cases  without 
actual  inspection  experience.  As  there  are  many  inspectors  who  have  had 
many  years  of  experience  in  precisely  the  area  concerned,  it  would  seem 
appropriate  to  make  a  survey  such  experts  to  obtain  a  multiple  opinion 
estimate  of  the  probability  of  detection  for  various  size  defects  under 
various  circumstances  and  inspection  methods.  The  experience  of  such  ex¬ 
perts  encompasses  much  unrecorded  and  intangible  information  that  would  not 
be  available  from  any  other  source.  The  few  well-documented  cases  of  un¬ 
detected  as  well  as  a  summary  of  cases  of  detected  defects  could  be  furnished 
to  them  to  assist  in  their  estimates. 


The  manufacturer’s  inspection  criticality  rating  analysis  can  also 
'•♦rovide  3oae  additional  information  on  detectability.  In  this  analysis, 
•ech  structurally  significant  item  is  rated  on  whether  a  defect  could  cause 
«  fuel  leak,  whether  the  item  was  ten  feet  or  more  from  the  ground,  and 
whether  Internal  damage  could  be  detected  by  an  external  inspection.  These 
ratings  (as  is  apparent  from  the  discussion  under  inspection  frequency)  are 
in  effect  defining  the  levels  of  inspection  in  which  a  defect  could  but  not 
necessarily  would  be  detected.  This  information  can  be  used  in  development 
of  cases  to  be  posed  in  the  multiple  opinion  survey. 

Visual  inspection  is  the  primary  inspection  method  used  by  the  air¬ 
lines  and  the  primary  type  considered  in  this  project.  However,  it  would 
be  desirable  if  the  model  and  multiple  opinion  survey  would  allow  for  con¬ 
sideration  of  supplementing  visual  inspection  by  other  inspection  methods 
such  as  x-ray,  eddy  current,  and  use  of  penetrant  aids.  The  actual  inspec¬ 
tion  with  these  alternate  methods  is  more  costly  than  a  visual  inspection 
but  the  cost  of  gaining  access  (such  as  disassembly  of  parts)  may  be  less 
expensive  and/or  the  probability  of  detecting  smaller  defects  may  be 
Increased. 


Inspection  Fronuonr..v 


Any  of  an  infinite  number  of  inspection  schemes  and  frequencies 


could  be  chosen  as  input  data  for  the  model  but  from  a  practical  standpoint, 
the  evaluation  has  to  be  limited  to  typical  inspection  programs  and  alter¬ 
nates  thought  to  be  feasible  by  experts  in  the  field. 


i 


A  "typical''  inspection  program  as  synthesized  from  descriptions 
in  various  papers  and  documents-^, 3  ancj  discussions  with  knowledgeable 
people  is  a  multi-level  program  as  follows: 

A  cursory  walk-around  inspection  every  8  to  25  flight  hours.  Three 
inspections  are  typically  entitled  -  enroute  service,  turnaround 
inspection,  or  terminating  pre-flight  check.  Discrepancies  such  us 
obvious  fuel  leaks  could  be  detected  in  such  inspections.  Pre-flight 
inspections  are  also  made  but  with  modern  docking  sy-tems  and  night 
flights,  these  are  relatively  ineffective. 

A  close  walk-around  inspection  every  50  to  100  hours.  These  inspec¬ 
tions  are  typically  entitled  -  service  checks,  A  or  B  checks  or  area 
checks  and  involve  6-12  manhours,  much  of  which  is  spent  on 
servicing  systems.  External  defects  in  structure  less  than  10  feet 
from  the  ground  as  well  as  significant  fuel  leaks  could  be  detected 
in  this  type  of  inspection. 

A  close  walk-around  inspection  plus  a  close  inspection  of  certain 
external  and  easy  access  areas  every  500  to  1,000  hours.  These 
latter  areas  are  selected  because  they  are  critical  and  easily 
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Th«  manufacturer's  inspection  criticality  rating  analysis  can  also 
provide  some  additional  information  on  detectability.  In  this  analysis, 
uch  structurally  significant  item  is  rated  on  whether  a  defect  could  cause 
a  fuel  leak,  whether  the  item  was  ten  feet  or  more  from  the  ground,  and 
whether  internal  damage  could  be  detected  by  an  external  inspection.  These 
ratings  (as  is  apparent  from  the  discussion  under  Inspection  frequency)  are 
In  effect  defining  the  levels  of  inspection  in  which  a  defect  could  but  not 
aecessarily  would  be  detected.  This  information  can  be  used  in  development 
of  cases  to  be  posed  in  the  multiple  opinion  survey. 

Visual  inspection  is  the  primary  inspection  method  used  by  the  air¬ 
lines  and  the  primary  type  considered  in  this  project.  However,  it  would 
ha  desirable  if  the  model  and  multiple  opinion  survey  would  allow  for  con¬ 
sideration  of  supplementing  visual  inspection  by  other  inspection  methods 
such  as  x-ray,  eddy  current, and  use  of  penetrant  aids.  The  actual  inspec¬ 
tion  with  these  alternate  methods  is  more  costly  than  a  visual  inspection 
hut  the  cost  of  gaining  access  (such  as  disassembly  of  parts)  may  be  less 
expensive  and/o'-  the  probability  of  detecting  smaller  defects  may  be 
increased. 

Inspection  Frequency 

Any  of  an  infinite  number  of  inspection  schemes  and  frequencies 
could  be  chosen  as  input  data  for  the  model  but  from  a  practical  standpoint, 
the  evaluation  has  to  bo  limited  to  typical  inspection  programs  and  alter¬ 
nates  thought  to  bo  feasible  by  experts  in  the  field. 


accessible  and  usually  involve  control  surfaces  and  hinges,  vhoal 
veils,  and  fixed  structure  surrounding  major  doors.  These  inspec¬ 
tions  are  typically  entitled  maintenance  checks,  C  checks  or  area 
checks  and  require  400  to  500  manhours  most  of  which,  are  spent  on 
powered  or  mechanical  systems  and  not  on  fixed  structure.  From  the 
standpoint  of  fixed  primary  structure,  this  level  of  inspection 
differs  from  the  previous  lower  level  in  that  access  is  gained  by 
swans  of  stands,  etc.,  to  structure  surrounding  control  hinges  and 
mJor  doors  which  are  more  than  ten  feet  from  the  ground.  Conse¬ 
quently,  defects  could  be  detected  in  this  additional  structure  in 
this  inspection. 

A  close  inspection  of  the  complete  exterior  of  the  airplane  every 
2,000  -  8,0GQ  hours.  Access  to  these  areas  is  gained  by  use  of 
work  stands,  "cherry  pickers",  etc.  Any  external  defect  could  be 
detected  in.  this  inspection. 

A  close  sampling  inspection  of  a  certain  percent  of  aircraft  every 
7#QQ0  to  16,000  hours  of  internal  structure  to  which  access  is 
gained  through  access  doors,  draining  of  fuel,  removing  cabin  liners, 
etc.  At  certain  points,  sealant,  fasteners,  etc_r  may  be  removed 
and  inspection  aids  used.  Structural  defects  in  internal  areas 
could  be  detected  in  this  level  of  inspection. 

Develor-^nt  of  Model 

E.  S.  Quade^,  defines  a  model  as  "a  simplified,  stylized  representa¬ 
tion  of  the  real  world  that  abstracts  the  causc-and-ef feet  relationships 
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essential  to  the  question  studied."  He  indicates  that  the  means  of  represen¬ 
tation  may  range  from  a  set  of  mathematical  equations  or  a  computer  program- 
to  a  purely  verbal  description  of  the  situation  in  which  intuition  alone  is 
used  to  predict  the  consequences  of  various  choices. 

It  is  apparent  that  an  infinite  number  of  different  models  couLd  be 
developed  for  any  situation.  The  dilemma  faced  in  developing  a  model  is 
that  to  make  the  model  realistic  in  all  respects ,  it  tends  to  be  complex  and 
yet  the  more  complex  it  is,  the  more  difficult  it  is  to  evaluate.  A  common 
method  used  to  simplify  the  model  is  to  consider  only  the  primary  relation¬ 
ships  affecting  the  problem  being  analyzed.  The  objective  is  to  develop  a 
model  which  is  as  realistic  as  necessary  to  solve  the  problem  and  yet  can  be 
evaluated  within  the  constraint  of  the  resources  available.  The  general 
problem  of  estimating  the  probability  of  aircraft  failure,  which  is  the 
purpose  of  this  model,  ha?  been  studied  from  two  diverse  approaches.  Eca- 
vert*l,  in  his  study  of  inspection  intervals  for  fail-safe  structures, 
predicted  the  probability  of  failure  of  a  typical  small  section  of  a  wing 
under  various  simple  inspection  schemes  by  means  of  a  rigorous  manual 
mathematical  analysis  supplemented  by  a  computer  analysis  of  some  of  the 
more  complex  aspects  using  Monte  Carlo  and  Step  Integration  procedures. 

From  this  study,  certain  conclusions  were  drawn  for  the  entire  structure 
under  the  operational  situation. 

^Sigge  Eggwortz  ar.d  Coran  Lindsje,  Study  of  Tir  portion  J;J  i — .  ?  -  f  :• 
Fail-Safe  Structures  (Stokholm,  Sweden:  Aeronautical  Research  institute  of 
Sweden,  1970). 
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k  v*ite  different  approach  waa  planned  for  the  fault  tree  analysis 
the  booing  Supersonic  Transport1.  It  was  planned  that  the  entire  air¬ 
plane  would  be  analyzed  for  all  accident  causes  and  the  probability  of  catas¬ 
trophic  accident,  be  estimated  using  the  fault  tree  analysis  technique 
Wtluat.ed  by  computer  simulation.  A  fault  tree  is  essentially  a  logic  dia¬ 
gram..  Simulation  was  planned  because  the  analytical  approach  was  considered 
tOO  time**C.Qnsuming,.  laborious,  and  error  prone  for  evaluating  fault  trees  of 
lb*  complexity  envisioned.  While  admittedly  a  much  more  ambitious  problem 
Vlttt  being,  solved.*  the  magnitude  of  effort  planned  was  much  greater  than 
expended;  by  Eggwectz.  in  his  study. 

Urn  onft  case.,,  a  small  but  typical  part  of  the  problem  was  evaluated 
bty  *.  rigorous;  mathematical  analysis  of  a  simplistic  model  and  the  results  of 
tfti*  ev.eXua.tion-.  was  extrapolated  to  draw  conclusions  about  the  whole  problem. 
Ulfc  the:  Other-  caae:,.  it  was  planned  that  the  whole  problem  be  analyzed  by  use 
<t£  teeXiatifi:  but  large  and  involved  model  which  could  be  evaluated  only  by 
OOmputejc  simulation.  In  the  first  case,  conceptually  the  model  was  simple 
but:  the..  mathemattcaL  solution  would  not  be  easily  understood  by  someone  not 
WftXJi  versed;  in: mathematics.  However,  in  the  second  case,  the  basic  element 
q£  the:  model:  t&-  £fc  Xogic  diagram  which  along  with  the  simulation  method  of 
SOliAtion-.can.be  easily  understood  by  a  layman. 

lor.- the.  project  being  planned  in  this  paper  to  be  effective,  the 
conclusions  must  be  realistic  and  valid  and  accepted  as  such  by  the 

toeing  Co.,.  SST  Fault  Tree  Analysis.  Document  No.  D*j.M07.c4-l 
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operational  personnel  who  establish  and  carry  out  the  inspection  program. 
'The  situation  being  modeled  is  an  exceedingly  complex  one  involving  many 
relationships  essential  to  the  question  being  studied.  The  conclusions  will 
not  be  accepted  if  the  model  is  not  understood  and/or  if  it  is  apparent  that 
there  are  important  factors  affecting  the  effectiveness  of  the  inspection 
program  which  are  not  considered  in  the  model.  The  large  apparent  dis¬ 
crepancies  between  actual  practice  and  inspection  programs  indicated  by 
simple  models  have  been  discussed  extensively  by  the  author  with  operational 
personnel.  Their  reactions  are: 

1.  The  model  was  not  realistic  as  it  does  not  account  for  important 
factors  such  as  corrective  action  and  supplemental  inspections; 

or, 

2.  The  complex,  flexible,  multi-level  actual  inspection  programs 
may  be  equivalent  to  the  simple  periodic  inspection  indicated  to 
be  necessary  by  the  model;  or, 

3.  The  model  must  be  wrong  because  service  experience  is  the  real 
proof  and  based  on  their  limited  view  of  it,  service  experience 
has  been  good. 

It  is  apparent  from  the  foregoing,  that  the  model  used  should  be  realistic 
and  easily  understood.  It  appears  that  approach  planned  for  the  supersonic 
transport  fault  tree  analysis  of  using  a  Logic  diagram  evaluat»J  by 
computer  simulation  would  be  most  effective  for  the  problem  at  hind.  The 
actual  model  couLd  bo  restrict*  d  in  size  to  stay  within  rescue*  c  ;tra  i\:  - 
by  analyzing  only  part  of  the  structure. 


tion  of  Structural  Elements 


This  topic  has  been  discussed  previously  in  a  general  way  under  a 
similar  heading.  However,  it  now  is  desirable  to  be  more  specific.  It 
would  be  ideal  if  each  structurally  significant  iten  defined  in  the 
criticality  analysis  (Figure  1)  were  homogenous,  independent,  and  not  re¬ 
dundant  (i.e.,  its  failure  would  be  catastrophic).  If  this  were  the  case, 
each  structurally  significant  item  could  be  considered  an  element. 
Unfortunately,  this  is  not  the  case  with  an  airplane  structure. 

This  study  is  concerned  t'ith  only  the  more  important  or  primary 

structure  of  the  airplane  whose  failure  is  likely  to  be  catastrophic.  On  a 

typical  airplane  this  structure  consists  of  the  fuselage  shell  (skin, 

stringers,  and  frames),  the  box  beams  in  the  wxng  and  empennage  surfaces, 

and  the  attachments  of  empennage  and  wing  to  the  fuselage.  The  fuselage 

shell  acts  as  3  beam  carrying  the  flight  loads  imposed  by  the  cabin  payload, 

as  supported  and  guided  by  the  wings  and  empennage.  The  wing  and  empennage 
* 

box  beams  carry  the  flight  loads  to  the  fuselage  as  beams  to  support  and 
guide  th«-  fuselage  through  the  fuselage  attachments.  Experience  has  shown 
that  the  loss  of  capability  of  these  structures  to  carry  flight  loads  is 
normally  catastrophic.  The  fuseLage  shell  also  acts  as  the  cabin  pressure 
vessel.  While  loss  of  pressure  containment  capability  is  not  usually 
catastrophic,  massive  failures  resulting  from  explosive  decompression  may 
be  catastrophic  because  of  loss  of  vital  systems  in  the  fuselage  shell  or 
because  the  flight  load  carrying  capability  of  the  fuselage  has  boor 
destroyed. 


The  flight  loads  produce  internal  bending,  shear,  and  torsion  on  the 
‘ving,  empennage,  and  fuselage  beams.  A  cross  section  of  a  typical  wing  box 
beam  is  shown  in  Figure  6.  Failure  of  such  a  chordwise  section  would  be 
catastrophic.  Typically,  the  bending  load3  are  carried  by  the  top  and 
bottom  covers  (skin,  stringers,  and  spar  caps),  the  shear  by  the  vertical 
vebs  of  the  spars,  and  the  torsion  by  the  boxes  formed  by  the  skins  and  spar 
vebs.  As  bending  and  torsion  are  carried  by  essentially  the  same  structure 
and  a  bending  failure  will  typically  occur  with  less  structure  failed,  the 
bending  mode  of  failure  could  be  considered  to  control.  Service  and  test 
failures  show  that  wing  bending  is  by  far  the  most  common  failure  mode.  A 
pure  shear  failure  under  normal  flight  loads  would  probably  involve  all 
three  of  the  vertical  webs  which  are  physically  separated.  As  defects  which 
grow  fore  and  aft  (i.e.,  chordwise  which  is  normal  to  the  principal  stress) 
are  the  primary  concern  here,  a  defect  in  one  spar  web  would  normally  have 
to  grow  through  an  adjacent  cover  to  reach  an  adjacent  spar  web.  Conse¬ 
quently,  a  pure  shear  failure  is  not  too  likely. 

In  view  of  the  above  situation,  to  obtain  an  element  which  is  not 
redundant  and  is  independent,  the  element  would  have  to  include  a  chordwise 
slice  of  the  compete  wing  box  as  shown  in  Figure  6.  This  would  include 
typical  failure  paths  and  is  necessary  for  independence  because  failure  in 
one  part  of  the  cross  section  affects  adjacent  members.  Fortunately,  except 
as  discussed  later,  one  chordwise  slice  of  structure  is  relatively  indepen¬ 
dent  of  defects  in  adjacent  inboard  and  outboard  slices,  and  encompass  the 
most  common  wing  failure  path.  However,  to  ensure  that  the  strength  degra¬ 
dation  of  multiple  defects  in  the  element  are  additive,  the  chordwise  slice 


Figure  6 

Gross  Section  of  Typical  Wing  Box  Seam 
(Reference  -  Boeing  747  Structures  Brochure) 
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CUSt.  be  rather  narrow.  A  review  of  service  and  test  failures  indicates  that 
4  vidth  of  five  inches  might  be  appropriate.  Again  fortunately,  research 
wrk  has  indicated  that  effects  of  chordwise  defects  in  any  of  the  chordwise 
elements  are  additive  both  from  a  residual  strength  and  crack  growth 
ttandpoint*.. 

The  element  defined  above  is  still  not  satisfactory  because  it  is 
nflt  homogenous.,  Typically,  the  lower  cover  is  more  critical  in  fatigue 
than:  the  upper  cover  or  the  spar  webs  and  typically  the  stresses  increase 
44  one,  transverse®  through  the  cross  section  from  the  front  to  the  rear.  A 
review  of  typical  designs  indicates  that  to  obtain  homogenity,  top  and 
hftttom  covers  of  the?  element  defined  above  should  be  divided  into  quarters 
4ndl  each,  spar  web-  should  be  treated  separately.  Thus,  the  old  element 
would,  result  In-,  etevem  new  elements.  The  new  elements  would  be  redundant, 
but  under  the  concept  shown  later  in  the  sample  logic  diagram,  this  problem 
Ofiuld.  b.e.-  handled  by  considering  all  elements  of  the  cross  section  to  be 
~  •'^ij^cenfc  elements..'" 

TS&  Chi®  point,,  only  chordwise  defects  in  the  wing  have  been  con- 
4tAcr.e<i..  Spanwisc  defects,  especially  cracks,  do  occur  in  service  but  have 
llittlc  effect  on  the  wing  except  on  its  torsion  carrying  capability  and 
appear  to  be  independent  of  chordwise  defects.  However,  extremely  long 
defects  arc  necessary  to  significantly  effect  the  torsional  strength. 

((tracks  as  long  as  six  to  ten  feet  have  been  experienced  in  service  without 

Laurence  Snider,  Franklin  L.  Reeder,  and  William  Pirkin, 
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wing  failure).  Consequently,  it  may  not  be  necessary  to  evaluate  spanwise 
defects  but  if  it  is,  spanwise  and  chordwise  defects  could  be  evaluated 
independently  using  corresponding  spanwise  and  chordwise  strips  of  the  wing 
box.  The  same  approach  could  be  used  on  the  fuselage  where  bending  is  the 
primary  flight  load  failure  mode  and  is  affected  primarily  by  circumferen¬ 
tial  defects  whereas  pressure  loads  are  primarily  affected  by  longitudinal 
defects.  The  above  approach  assumes  that  failure  in  one  principal  direc¬ 
tion  of  stress  are  independent  of  failures  in  the  other  principal  direction 
of  stress  and  that  failures  in  adjacent  parallel  elements  are  independent. 

Sample  Logic  Diagram 

Based  on  the  foregoing  discussions,  the  author  developed  a  sample 
logic  diagram  which  is  described  in  detail  and  shown  in  Figure  9  in  the 
Appendix.  This  diagram  illustrates  the  life  of  a  structural  element  as  it 
progresses  through  development  and  production  phases,  enters  service,  and 
repetitively  progresses  through  flight  and  post-flight  phases.  The  element 
either  develops  defects  or  not  in  any  one  of  these  phases  and  the  defects 
are  either  catastrophic  or  not  and  are  either  found  or  not  found  in  post¬ 
flight  inspections.  The  discovery  of  these  defects  either  results  in 
modifications  of  the  element  and/or  inspection  program  or  does  not.  The 

s' 

service  portion  of  the  logic  diagram  is  repeated  until  the  airplane  crashes 
or  is  retired  from  service. 


This  clement  logic  diagram  could  provide  the  basic  building  block 
for  a  computer  program  for  evaluating  the  effectiveness  of  a  given  inspec¬ 
tion  program  for  a  fleet  of  airplanes  of  a  given  design  which  is  developed 


aod  operated  under  a  given  set  of  policies.  By  use  of  computer  simulation 
techniques,  as  shown  in  the  flowchart  of  Figure  7,  each  element  of  each 
airplane  could  be  run  through  the  development  and  production  phases  of  the 
diagram  as  each  airplane  enters  service  and  then  repetitively  "flown" 
through  the  service  phase  of  the  logic  diagram  on  a  flight-by-flight  basis 
until  retirement  or  failure  with  the  inspection  program  and/or  structure 
modified  as  indicated  by  the  logic  diagram  after  each  "element  flight"  and 
each  "fleet  flight"  (i.e.,  a  "fleet  flight  is  completed  when  all  elements 
of  all  airplanes  in  the  service  fleet  have  been  "flown"  through  one  flight) 
It  Is  anticipated  that  the  computer  program  would  account  for  the  fact  that 
all  airplanes  of  a  given  design  do  not  enter  service  at  the  same  tine  and 
that  the  entire  fleet  would  be  "flown"  through  the  program  on  a  flight-by- 
f light  basis.  That  is,  no  element  of  any  service  airplane  would  embark  on 
another  flight  until  all  elements  of  all  service  airplanes  had  completed 
the  previous  flight.  This  approach  ha*  the  advantage  in  that  it  reflects 
reality  wherein  test  and  service  experience  on  any  airplane  affects  subse¬ 
quent  actions  on  all  production  and  service  airplanes.  It  is  also  antici¬ 
pated  that  to  simplify  the  program,  all  calendar  flight  times  and  fatigue 
lives  would  be  expressed  in  terras  of  the  number  of  flights  that  an  average 
wirplane  would  havp-  made  during  the  number  of  days  or  flight  hours  involved 
This  is  based  on  the  assumption  that  all  airplanes  will  make  the  same  numbe 
of  flights  p:r  hour  and  pur  day. 

The  expected  results  for  a  given  situation  could  be  obtained  by  re¬ 
peated  fleet  trials  of  "flying"  a  fleet  through  the  program  from  introduc¬ 
tion  of  the  design  into  service  to  retirement  of  all  aircraft  of  the  given 


design  with  the  results  recorded  for  each  trial  and  averaged  for  many 
trials  to  obtain  the  expected  results. 
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Figure  7 
(3  Sheets) 
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Computer  Simulation  Flow  Chart 
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OF  TYPE  OF  NEXT 


DEVELOPMENT  OF  METHOD  FOR  SYSTEM  COST  EVALUATION 


Objective  and  Obstacles 

As  indicated  in  the  definition  of  the  problem,  the  ideal  structural 
Inspection  program  would  be  a  minimum  cost  program  in  which  all  significant 
related  costs  are  fully  accounted  for.  Consequently,  it  is  the  objective 
of  the  system  cost  evaluation  to  identify  all  significant  costs  and  within 
the  constraints  on  the  study,  to  estimate  these  cost  for  poss.ible  variations 
in  the  system.  The  major  problem  is  to  realistically  estimate  the  costs 
for  the  system  variations.  The  major  obstacles  are  that  a  great  deal  of 
data  is  needed  to  determine  the  costs  and  the  system  is  extremely  complex. 
Fortunately,  the  system  model  described  in  the  preceding  chapter  and  in  die 
Appendix  can  provide  the  necessary  cost  information  as  discussed  below. 

Significant  Costs 

As  previsouly  mentioned  in  the  definition  of  the  problem,  as  the 
inspection  effort  increases,  defects  are  found  before  they  become  large 
and  result  in  major  repairs  or  accidents.  Likewise,  if  modifications  are 
incorporated,  defects  are  prevented.  Further  if  a  full  scale ' fatigue  test 
of  the  entire  airplane  is  performed,  hidden  deficiencies  can  be  discovered 
prior  to  service,  special  inspections  instituted,  and  modifications  incor¬ 
porated  to  prevent  service  defects.  Consequently,  it  is  apparent  that 
inspection  costs,  repair  costs,  accident  costs,  modification  costs  and  full 
acalc  fatigue  test  costs  are  significant  costs  related  to  the  structural 
inspection  program.  Airplane  down  time  costs  are  also  a  major  cost,  having 
been  estimated  to  be  39,000  dollars  a  day  for  the  Boeing  747.  However,  if 
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typical  maintenance  practices  and  situations  are  assumed,  down  time  can  bi 
accounted  for  by  applying  an.  historical  factor  to  inspection,  modification 
and  repair  costs.  In  the  case  of  planned  activity  such  as  inspections,  the 
down  time  costs  should  be  prorated  between  structural  inspection  and  the 
Other  maintenance  being  concurrently  performed. 

Estimation  of  Individual  Cost  Components 
Inspection  and  Repair  Costs  . 

The  model  described  in.  the  Appendix  would  accumulate  the  inspection 
and  repair  (including  down  time)  casts  for  each  inspection  level  as  part  of 
the  determination  in  operation  DS16  of  whether  a  modification  should  be 
developed.  By  totalling  these  costs,  the  inspection  and  the  repair  costs 
can  be  determined  for  the  complete  life  of  the  structure  being  evaluated. 

The  cost  input  ter  the  model  can  be  obtained  from  historical  data  on  past 
airplanes  by  multiplying  the  total  cost  for  the  percent  of  the  total  effort 
per  visit 'applied  ta  structural  inspection  or  repair  of  a  particular  element. 
The  resulting  cost  should  be  corrected  to  the  size  of  the  airplane  being 
evaluated  by  the  ratio  of  airplane  empty  weights.  The  maintenance  costs  for 
operational  airplanes  are  published  periodically  in  trade  magazines  such  as 
"Aviation  Week"'.,  The  manhours  for  first  and  second  level  of  inspection 
(which  is  the  major  expense)  for  the  past  narrow  body  jet  transports  were 
given  in  the  section  on  "Inspection  Frequency".  Repairs  made  for  defects 
found  in  the  first  level  of  inspection  may  result  in  flight  cancellation  and 
down  time  which  should  be  added  to  the  cost  of  the  repair.  A  review  of  present 
Jet  transport  experience*  indicates  that  they  average  2.6  days  ao wn  time  per 

*J.  M.  WoljMst,  "Structural  Character  of  the  Jet  Age. 11  Proceedings 
of  the  1^68  ATA  ^rar**  ir»d  l,iiri~  'mpfr  rnp^renco,  Phoenix.  \riz. 

(Washington,  D.  C.:  Air  transport  Association  of  America,  Ivob). 
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year  for  2.5  such  cancellations,  tfolgast's  review  also  indicated  that  for 
*  Block  Overhaul  visit,  which  is  essentially  a  third  level  inspection  plus 
•oc-fourth  of  a  fourth  level  inspection^,  the  typical  airplane  required: 

1250  manhours  for  structural  inspection  plus 
942  dollars  for  outside  services; 

1933  manhours  for  structural  repairs  plus 
1375  dollars  for  materials  for  152  discrepancies;  and 
2050  manhours  for  structural  modification  plus 
1375  dollars  for  materials. 

Wolgast's  review  also  shows  that  structural  maintenance  typically 
represents  eight  to  ten  percent  of  airline  direct  maintenance  cost  and 
accounts  for  twelve  to  fifteen  days  of  down  time  per  year  of  which  a  large 
part  could  be  eliminated. if  all  structural  maintenance  were  to  be  eliminated. 
It  is  believed  that  with  these  sources  of  information  available,  adequate 
ostimates  can  be  made  of  structural  maintenance  costs. 

Modification  Costs 

.  The  model  in  the  Appendix  also  estimates  the  modification  cost  in 
operation  DS16  for  each  modification  developed.  This  value  could  be 
accumulated  to  give  total  modification  costs.  The  input  data  could  be 
obtained  in  the  same  manne.  as  for  inspection  and  repair  costs  except  that 
the  cost  of  testing  the  notification  would  have  to  be  estimated  from 
historical  data.  The  model  covers  only  fatigue  modification  costs. 


^Ansvitt,  "Aircraft  Structural  Sampling  Inspection  Programs,"  p. 


Corrosion  modification  costs  were  not  covered  as  no  practical  way  could  be 
found  to  estimate  the  unmodified  corrosion  defect  occurrence  rate.  As  a 
review  of  reported  defects  for  the  Boeing  720  indicates  that  approximately 
25  fatigue  defects  occur  for  every  corrosion  defect,  this  lack  of  evaluati. 
Of  corrosion  modification  policies  should  not  be  critical.  The  model  also 
does  not  account  for  costs  of  modifications  developed  from  the  full  scale 
fatigue  test  because  different  criteria  would  be  used  to  decide  whether 
Such  modifications  should  be  developed.  The  model  simulation  would  record 
•uch  modifications  and  could  be  easily  changed  to  account  for  their  costs. 
Also  the  model  does  not  account  for  the  lower  cost  of  incorporating  modifi¬ 
cations  before  rather  than  after  delivery.  Military  experience  indicates 
that  a  production  modification  costs  approximately  thirty  percent  of  that 
of  a  modification  made  after  delivery.  Such  a  factor  could  be  applied  to 
production  modifications. 

Accident  Costs 

This  study  is  limited  to  vital  primary  metal  structure  (fuselage 
«h«llt  ving  and  empennage  box  beams,  and  fuselage  attachments).  Accident 
records  indicate  that  failure  of  such  structure  is  either  catastrophic  re¬ 
sulting  in  loss  of  airplane  and  occup  nts  or  resulting  in  a  repair  propor- 
tioaal  to  the  si'ao  of  the  failure.  Such  failures  rarely  result  in  non- fata 
accidents  wherein  tna  airolar.e  is  further  damaged  or  destroyed.  The  costs 
of  non-catastcophic  failures  is  covered  under  repair  costs.  The  model 
described  in  the  Appendix  will  o;ti-ita  the  expected  number  of  catastrophic 
failures  for  the  lifetime  of  a  flo»t  for  a  given  situation.  The  accident 
costs  can  be  obtained  by  multiplying  the  valuation  of  airplane  and  occupant 


tines  this  expected  number.  The  value  of  the  airplane  can  be  easily  esc.- 
mated  from  original  or  depreciated  cost.  The  cost  of  a  Boeing  747  is 
approximately  20,000,000  dollars*-.  The  economic  value  of  human  life  is  of 
course,  a  very  emotional  and  controversial  subject.  However,  a  study  of 
the  subject^  suggests  a  value  on  the  order  of  500,000  dollars  for  an  cu  ... 
passenger  in  1975  based  primarily  on  present  value  of  expected  future 
earnings. 

Full  Scale  Fatigue  Test  Cost 

A  full  scale  fatigue  test  is  not  always  performed,  or  continued  co 
its  maximum  length,  in  a  development  program  as  it  is  extremely  expensive. 
(The  Boeing  747  fatigue  test  was  estimated  to  cost  25,000,000  dollars  for 
60,000  accelerated  flights.)  Yet  the  existence  and  length  of  the  full 
scale  fatigue  test  effects  structural  maintenance  costs.  The  cost  of  such 
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a  test  can  be  estimated  from  a  report  by  Harpur  and  Throughton  as  a  func¬ 
tion  of  size  of  airplane  and  length  of  test. 

Costs  Not  Considered 

Neither  the  costs  of  corrosion  modfications  nor  the  cost  of  lost 
business  because  of  a  bad  accident  record  have  been  considered.  The  first 
cost  is  not  considered  to  be  vital  to  optimization  of  structural  inspection 
and  the  latter  cost  is  considered  to  be  too  nebulous. 


Crash 

Calif 


*D.  L.  Greer  and  W.  E.  Knap  ton.  Cost fit  of  Inc^-or 

R.  -jqfnt  F" ' !  Ten1  in  i  Civil  T.  c  i'r  ir  p-f.  \ircri:t  ( Son  Jm;j 
:  Convair  division  ot  G.-r.eral  uynemi.es,  IV/U). 
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'■Gary  Fromm,  Economic  O^it^rii  for  Federal  Aviation  Aeoncv  Expendi¬ 
tures  (Cambridge,  Mass.:  United  Research  Corp. ,  l  *62). 
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N.  F.  Harpur  and  A.  J.  Trough ton,  "Thu  Value  of  Full  Scale  Fatigue 
Testing, "  Pro<-e<»«lin-»s  of  Intorn.it  jona  i  Committee  on  Aircraft  Fiti-oe,  *  unich , 
1965.  (Oxford,  England:  Pergaraen  Press,  I'Oj).  Fig.  14. 
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SUMMARY 

lht«  paper  presents  a  plan  for  FAA  development  of  a  method  for 
establishing  aircraft  structural  inspection  programs  on  a  rational  basis  and 
a  justification  for  such,  development.  As  a  plan  must  define  the  tasks 
mecessary  to  achieve  the  objective,  the  definition  of  these  tasks  has 
•■turally  resulted  in  a  preliminary  development  of  the  actual  method. 

The  motivating  force  far  this  development  is  the  belief  that  present 
structural  inspection  programs,  which  represent  a  massive  effort,  are  far 
from  optimum.  To  date  these  programs  have  been  largely  developed  a  judgemen¬ 
tal  basis  from  past  experience  with  no  attempt  to  use  existing  analytical 
techniques  and  data  to  estimate  whether  the  resulting  safety  level  would  be 
adequate.  The  result  has  been  a  trend  of  ever-decreasing  inspection  effort. 
Service  history  was  reviewed  and  it  was  found  that  seven  fatal  accidents 
Involving  transports  of  IT.  S.  or  British  design,  have  occurred  in  the  last 
•even  years  because  the  inspection  did  not  detect  structural  defects. 

i 

Further,  laboratory  testing  has  indicated  that  structural  defects  could 
initiate  and  grow  to  failure  within  some  of  the  current  inspection  intervals. 
Conversely,  inspection  personnel  were  contacted  and  their  reaction  was  that 
much  of  the  present  inspection  effort  is  unnecessary.  It  was  concluded  that 
FM  development  of  a  method  for  establishing  structural  inspection  programs 
on  a  more  rational,  scientific  basis  than  presently  used  might  provide  real 


benefits. 
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Rational  development  required  a  model  which  would  permit  an  apriori 

.evaluation  of  the  effectiveness  of  an  inspect! sn  program.  The  effectiveness 
% 

is  measured  by  the  degree  to  which  defects,  resulting  from  various  hazards, 
are  detected  prior  to  their  causing  accidents  or  major  repairs.  Rocognizir.0 
the  "garbage  in,  garbage  out"  problem  as  a  major  obstacle,  considerable 
effort  was  made,  even  prior  to  developing  a  preliminary  model,  to  assure 
that  valid  data  could  be  obtained  from  available  sources  for  the  input  re¬ 
quired  by  the  model. 

A  preliminary  scenario  of  the  model  identified  the  major  input  data 
requirements  as  -  (1)  defect  occurrence  rates  for  each  hazard,  (2)  strength 
degradation  rates  for  fatigue  and  corrosion  defects,  and  (3)  inspection 
frequency  and  reliability.  A  search  of  the  literature  and  service  experience 
identified  initial  fatigue,  corrosion,  birth  defects,  and  service  damages  as 
the  primary  hazards  which  could  be  minimized  by  inspection.  The  available 
sources  for  input  data  were  evaluated.  It  was  concluded  that  items  (1)  and 
(2)  above,  could  be  obtained  from  a  review  of  airline  mechanical  reliability 
reports,  the  manufacturers  design  data,  and  the  literature  on  structure  and 
that  inspection  reliability  estimates  could  be  obtained  from  a  survey  of 
maintenance  experts. 
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The  modeling  approach  selected  was  of  using  computer  simulation  to 
evaluate  a  relatively  complex  model  covering  a  major  portion  of  the  primary 
structure  of  the  airplane  and  accounting  for  most  of  the  major  variables  of 
service  usage  and  inspection.  This  approach  was  selected  over  using  a 
rigorous  mathematical  analysis  to  evaluate  a  simple,  idealized  model  because 
it  was  considered  to  be  more  realistic  and  more  easily  understood  by  the 
layman. 


A  great  deal  of  effort  was  expended  in  the  definition  of  the  plannee 
computer  simulation  by  the  simulation  flow  chart  of  Figure  7  and  the  logic 
diagram  in  the  Appendix  to  assure  that  the  simulation  would  be  reasonably 
valid  and  realistic.  A  procedure  for  dividing  the  structure  into  elements 
was  outlined.  The  logic  diagram  illustrates  the  life  of  such  an  element  ,.s 
it  progresses  through  developmental  and  production  into  service  and  repeti¬ 
tively  through  flight  and  post-flight  phases  with  defects  occurring,  being 
detected  or  resulting  in  failure  thus  causing  changes  in  inspection  and/or 
structure.  The  logic  diagram  and  flow  chart  defining  the  simulation  were 
submitted  to  Control  Data  Corporation  who  advised  that  the  approach  was 
feasible  from  a  computing  standpoint  and  provided  a  cost  estimate  for  the 
simulation. 

Rational  development  of  an  inspection  program  also  required  an 
apriori  evaluation  of  the  associated  inspection,  repair,  modification,  and 
accident  costs.  An  approach  was  outlined  for  estimating  these  costs  from 
the  information  generated  in  the  computer  simulation  of  the  inspection 
effectiveness  model.  Accident  costs  were  based  on  aircraft  losses  plus  the 
estimated  future  earnings  of  the  occupants.  Minimization  of  the  above  costs 
was  selected  as  the  optimization  criteria.  At  this  point  a  major  conclusion 
of  the  paper  was  reached  -  that  a  valid  rational  method  of  establishing  an 
airplane  structural  inspection  program  was  feasible. 

To  determine  whether  FAA  development  of  the  rational  method  was 
desirable,  estimates  were  made  of  the  benefits  and  of  the  costs  of  develop¬ 
ment  and  application.  The  cost  of  development  3nd  application  to  a  hypothe¬ 
tical  fleet  was  estimated  to  be  $316,000.  The  benefits  were  predicted  from 
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LOGIC  DIAGRAM  AND  SYMBOLOGY 


The  logic  diagram  outlined  in  the  body  of  this  study  is  further 
defined  in  this  Appendix  by  showing  the  diagram  in  more  detail  in  Figure  9 
and  by  describing  the  functional  relationships  and  their  basis. 

As  original  symbology  was  used  in  the  logic  diagram,  it  will  be 
described.  Each  horizontal  line  segment  between  intersections  with  circles 
and/or  vertical  lines,,  indicates  a  state,  a  range  of  states  or  an  event.  A 
chain  of  these  horizontal  line  segments  gives  the  life  history  of  a  given 
element  in  a  given  airplane..  Each  circle  indicates  a  functional  relation¬ 
ship  which  determines  what  event  or  state  will  follow.  The  letters  in  the 
circle  indicates  the  type  of  function  as  follows: 

First  Letter  - 

C  -  indicates  that  a  simple  constant,  which  does  not  change 
throughout  the  simulation,  is  applied. 

D  -  indicates  th-il  tunct! anal  relationship  is  deterministic. 

P  -  inuicates  that  functional  relationship  is  probabilistic. 

Second  Letter  - 

D  -  indicates  that  turn,  tiunal  relationship  is  dependent  only  or; 
information  generated  in  the  developmental  or  production 
phases. 

S  -  indicates  taut  functional  relationship  is  dependent  on 
information  general* d  in  the  service  phisp. 


The  numbers  in  the  circles  identify  the  particular  functional  rela¬ 
tionship,  -The  vertical  lines  indicate  that  the  logic  diagram  chat  follows 
applies  to  each,  of  the  states  or  events  whose  horizontal  line  is  intersected. 
The  arrows  indicate  that  the  state  or  event  which  it  points  to,  automatical 
follows. 

It  is  suggested  that  the  multiple  sheets  of  the  logic  diagram  be 
removed  from  the  report  and  taped  together  to  make  the  diagram  easier  to 
follow. 


Functional  Relationships 

The  functional  relationships  identified  on  sample  logic  diagrams  are 
dkfined.  ia  the  following  paragraphs  which  are  identified  by  the  functional 
relationship  symboL..  The  X  symbols  and  associated  numbers  identify 
variables  which,  may  change  during  simulation  of  a  given  situation.. 

C3L  »  "The  predicated  average  fatigue  life  of  element  by  analysis"' is  a  con- 
* 

stand;  number  of  average  flights  which  can  be  obtained  from  a;  summary  of 
trite  fatigue  analysis^  for  the  pertinent  area  of  structure..  It:  must  be 
corrected  for  the  size  effect  involved  in  going  from  the  test  specimen 
am  which  the  analysis  is  based  to  a  structure  the  size  of  the  element?. 
This  correction,  is-  based  on  the  concept  that  the  probability  of’  a 
fatigue  crack  not  initiating  in  a  large  structure  is  equal  to  the 

^Such.  as  given  in  Boeing  Co.  brochure,  Boeing  7&7  F.iti'vie  Integrity 
Program.  Document  ^o.  D6  -  13050-773  (Seattle,  Wash.:  Boeing  Co. ,  l-.'/O). 

?BLkorsky  Aircraft,  Fatigue  Properties  and  Analysts,  p.  36,. 


product  of  the  probabilities  of  each  part  not  initiating  a  crack,  on 
this  basis,  the  probability  of  failure  of  a  structure  four  times  the 
size  of  another  structure  is  approximately  four  times  greater,  all 
other  things  being  equal.  With  the  relative  probabilities  bnown,  the 
cstrracticnx  may  be  made  by  obtaining  a  fatigue  life  distribution 
(.typically  log-normal)3-  and  a  standard  deviation  from  the  literature 
end  interjecting  the  relative  failure  probabilities. 

IDI  -  fatigue  analysis  is  notoriously  inaccurate,  the  actual  average 

fatigue  life  of  elements  of  a  given  design  (X2)  will  usually  be  differ¬ 
ent  than  predicted  by  analysis.  The  probability  of  the  actual  life 
boirrg  a  given  percentage  greater  or  less  than  predicted  could  be  ob¬ 
tained;  from  a  British  study  of  the  subject^.  By  plotting  this  proba¬ 
bility  as.  a  cumulative  frequency  curve  and  by  use  of  Monte  Carlo 
computer  techniques3  the  percentage  correction  factor  (XI)  can  be 
established  for  a  given  fleet  trial.  The  value  of  XI  would  change 
with:  each  fleet  trial  but  would  have  to  be  calculated  only  once  for 
trikes  first  element  to  enter  service  on  each  fleet  trial  and  then  only 
antst  far  all  elements  (regardless  of  location  in  the  airplane)  of  the 
came  design  ^with  the  same*  general  loading.  The  same  cumulative 
frequency  dirve  can  be  used  tor  ail  clement  design. 


ET.  Diet-r  arid  R.  F.  Mehl ,  T-v^ti  tti of  the  qtatH-ica1  Vir-iro 

of  the  Fat;  - ■  '••».>?  .  ~  d  r :  -  ■ 1  '  .  ■  <!  •  (  .as.un  ;ton,  L>.  C.:  .Wu-oaul 

Advisory  Ce.  ...il.w  .01  <uU\.jui,;c^. 

^BaXtiiby,  A  Comparison  <n  Pr.-Mctr-d  iml  .V-ni.-v  1  FiM  lives 

^Maurice  Siiienl,  Arthur  Yaspin,  and  Laurence  Friedmn,  Q i «->"i 
Research  -  **  1  :  s-  i  Ary^j •  (New  York:  John  Wiley  it  Sons,  Inc,,  l  >b'0, 

p.  y>. 


DS1  -  This  functional  relationship  is  a  simple  variable  (X3)  which  indicates 
•  for  a  given  fleet  trial  whether  any  previous  decision  has  been  made  co 
develop  a  fatigue  modification  for  a  given  element  design  in  a  given 
airplane  location.  The  logic  diagram  assumes  that  if  a  previous  servi.  • 
fatigue  failure  has  instigated  a  design  modification,  a  fatigue  test 
failure  will  not  instigate  an  additional  modification. 

DD1  -  This  function  for  determining  whether  the  airplane  fatigue  test  has 

exceeded  the  average  design  fatigue  life  of  an  element  before  a  given 
element  enters  service  is  a  direct  arithmetic  relationship  to: 

(X4)  the  production  number  of  the  airplane  being  evaluated  (entering 
service) . 

(C2)  the  number  01  airplanes  produced  per  unit  of  time. 

(X5)  the  time  since  first  airplane  entered  service. 

(X6)  the  time  between  (plus  or  minus)  first  airplane  delivery  and  start 

of  the  fatigue  test  (would  be  infinite  if  never  started). 

(C3)  the  number  of  accelerated  flights  on  fatigue  test  per  unit  of  time. 

(C4)  the  acceleration  factor  on  fatigue  test. 

(X2)  the  actual  average  fatigue  life  of  element  design;  and 

(C5)  maximum  number  of  accelerated  flights  to  be  imposed  in  fatigue 
s 

* 

test.  ' 

The  logic  diarrim  assumes  that  a  fatigue  test  failure  of  the  element 
will  occur  when  the  number  of  simulated  flights  on  the  fatigue  test 
times  C4  exceeds  X2.  It  is  alsc  assumed  that  production  test  rates  are 


constant. 


DD2  -  It  is  assumed  that  decision  whether  or  not  to  install  a  modification  o 


a  given  element  in  a  given  location  will  depend  only  on  whether  the 
average  fatigue  life  of  the  unmodified  design  (X2) ,  as  reflected  by  th 
teat  failure,  exceeds  a  pre-selected  level  (C6) . 

DD3  -  This  functional  relationship  reflects  the  policy  assumed  for  the  gi.;--  n 
situation.  Experience  on  the  Boeing  7A7  indicates^-  that  the  polic  / 
be  adequately  defined  by  the  percentage  (C7)  of  test  failure  life 
at  which  increased  inspections  become  effective  and  by  the  factor  (Ob' 
by  which  the  close  external  inspection  frequency  is  increased  and  by 
the  factor  (C9)  by  which  the  sample  size  of  internal  inspections  would 
be  increased. 

CIO  -  This  is  a  constant  which  reflects  the  policy  assumed  on  whether  or  net 
modifications  are  to  be  tested  before  installation.  The  logic  diagram 
assumes  that  ir  tested,  cue  modification  will  have  a  longer  lead  Li.;c 
but  the  average  modified  fatigue  life  (X7)  will  be  the  same  as  predict 
for  the  original  design.  However,  if  not  tested,  there  is  a  possibili 
of  the  fatigue  life  being  different  than  predicted. 

DS2  -  Whether  modification  is  available  for  production  incorporation  is  a 
direct  arithmetic  function  of: 

(X8)  the  time  between  first  airplane  delivery  and  the  decision  to 
develop  mod  if ieution; 

(Cll)  the  lead  Lime  to  produce  modifications; 

1  Boeing  Co.,  747  'Iftueturtl  In -poet  ion  Pro/r  im  Revision,  Fe'».  ?-3 
(Seattle,  Wash.:  Boeing  eo.,  l'J/i). 


(C12)  the  lead  time  to  Incorporate  modification  in  production;  and 
(X4)  and  (C2)  which,  can  be  used  to  determine  time  between  delivery  oc 
this  airplane  and  the  first  airplane  delivered. 

The  logic  diagram  assumes  chat  if  a  modification  has  bee.'  .  >volop< 
a  given  element  and  it  is  available  for  production  incor,  oration  lx 
delivery,  it  will  be  installed.  It  also  assumes  that  u  ...v,lif icatii 
not  available  at  the  time  the  decision  is  made  to  develop  a  modifi  . 

DD4  -  The  inspection  coverage  of  each  element  will  be  defined  when  tne  first 
airplane  of  a  given  design  enters  service  and  wouiu  not  have  to  bt. 
re-defined  for  any  subsequent  s aula t ions .  It  may  be  desirable  to 
perform  DD4  through  C17  manually  for  each  eleu.ene  prior  to  computer 
simulation. 

C13  thru  Ci7  -  These  are  co..-,ccr.t a  which  *-ve  structural  element  and 

inspection  coverage  as  indicated  and  can  be  obtained  from  inspection 
criticality  analysis  (See  Figure  1).  Tne  inspection  coverage  indicated 
by  the  logic  diagrac.  is  baaed  on  previous  discussions  in  the  body  of 
this  report  under  "Inspection  Frequency"  and  "Inspection  Reliability". 
The  logic  diigram  assumes  that  there  is  no  sigml ic.nt  chance  of 
detecting  defects  in  inspection  which  do  rot  cover  a-  feei  r*  as  <  .. 
fatigue  hie. 

PD2  -  The  service  loading  environs. nt  varies  considerably  be two* n  individual 
airplane.^.  The  purpose  of  th.s  tunct tonal  relationship  l 

^Ander  j.i-  r  .i,  "itj gu-'  ‘’aih ■  ►  >ntj  < r  t * •  -1  _ :  r-  •  r>.  2. 
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*  correction  factor  (X9)  to  multiply  times  the  actual  average  fatig. 
life  (X2  or  X7)  for  a  mean  load  environment  to  obtain  the  actual 
average  fatigue  life  of  the  element  for  the  loading  environment  of  a 
given  airplane.  By  assuming  a  distribution  for  the  variation  of  th 
rate  of  flight  load  occurrence  between  airplanes  (typically  log-n.s  aix* 
and  a  standard  deviation  for  the  distribution,  the  ratio  of  the  rate  .  f 
load  occurrence  to  the  mean  can  be  obtained  for  an  individual  airpia 
by  the  previously  discussed  Monte  Carlo  methods.  The  inverse  of  this 
ratio  to  the  mean  will  equal  X9.  A  separate  correction  factor  (X10) 
would  have  to  be  obtained  by  similar  means  for  elements  loaded  by  cabin 
pressure  loads.  It  should  be  noted  that  the  average  fatigue  life  for 
an  individual  element  with  the  latest  modification  (X7)  and  the  average 
fatigue  life  for  an  individual  element  with  the  previous  (or  no)  mod  if i- 
cation  (X2)  varies  as  the  element  goes  through  its  life,  experiences  a 
load' 'environment  different  from  the  leceivac  production  ar.i/cr 

service  damage,  corrodes,  is  repaired  and  sc  on. 

DD5  -  The  predicted  crack  growth  rate  for  the  type  of  construction  and 

material  and  a  test  loading  environment  can  be  obtained  from  manufac¬ 
turers  test  data  (such  as  shown  in  Figure  3)  as  discussed  under  ".{ate 
of  Strength  Degradation  Due  to  Fatigue".  It  is  anticipated  that  thic 
variable  rate  can  be  approximated  by  two  constant  rates,  one  reprt.  ant¬ 
ing  the  earlier  slower  crack  growth  period  (CIS)  and  a  higher  rau 
(C19)  starting  when  the  crack  reaches  the  critical  crack  length  (030). 

^Dieter,  Investigation  of  the  Statistical  Nature  of  Fatigue  of  Metals. 
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DD6  -  The  predicted  fatigue  crack  growth  rate  for  the  element  c..n  be  obtai 
by  multiplying  the  crack  growth  rates  of  DD5  by  conivti.n  f.n-tov:.  to 
account  for  differences  between  the  load  environment  i*i  the  particular 
element  in  the  particular  airplane  and  the  test  and  for  differences 
between  the  corrosive  environment  of  the  test  and  the  element  in  t  .j 
airplane.  The  correction  factor  for  the  load  environment  would  be  ti  ' 
inverse  of  the  product  of  X9  or  X10  and  the  ratio  (XI 1;  of  the  test 
rate  of  load  occurrence  to  the  mean  service  rate  of  load  occurrence  -cr 


a  given  element.  The  severity  of  the  corrosion  environment  of  tn« 
element  in  the  airplane  is  defined  the  corrosion  rating  factor  in  the 
manufacturer's  Inspection  Criticality  Analysis  Figure  1.  The  multiply¬ 
ing  factor  (C21)  by  which  the  corrosive  environment  (represented  by  the 


rating)  accelerates  fatigue  crack  growth  can  be  obtained  from  ger.eraliz 
fatigue  tests  under  such  environment*.  The  critical  crack  length  (C20) 


of  DLj  Suuuid  jd  expressed  in  terms  ox  reduction  v. 


cent  of  design  limit  load)  that  would  be  caused  by  a  crack  of  that 


length  in  the  section  defined  by  the  element  and  "adjacent"  oiez<_r.ts. 


To  be  most  useful  the  crack  growth  rates  should  also  be  in  these  terms. 


DD7  -  The  corrosion  degradation  rate,  as  previously  discussed  under  this 

i 

general  heading,  could  be  obtained  from  well  documented  cases  of  corro¬ 
sion  in  service  and  expressed  as  straight  line  functions  of  the 
corrosion  resistance  rating  of  the  element  (C22)  and  the  time  to  ini¬ 
tiate  corrosion  (X12) .  The  generalized  degradation  rte  should  be 
expressed  in  terms  of  cross  sectional  area  lost  per  Sin  hi.  This 
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functional  relationship  could  hold  for  all  elements  in  tlu  airplane 
with  it  the  corrosion  degradation  rate  established  for  the  clement 
function  of  time  to  initiate  corrosion. 

DD8  -  This  function  changes  the  corrosion  degradation  rate  function  of  DO/ 

a  strength  degradation  rate  by  multiplying  the  rate  by  a  factor  repre¬ 
senting  the  strength  (in  per  cent  of  design  limit  load)  lost  in  the 
section  (defined  by  the  element  and  "adjacent’'  elements)  per  unit  of 
cross  sectional  area  lost.  This  function  can  be  defined  as  a  straight 
line  function  of  X12  by  slope  (C23)  and  intercept  (C24). 

PD3  -  The  probability  that  an  element  will  enter  service  with  a  production 
defect  involves  an  "either  or"  or  binomial  probability  distribution. 

The  probability  of  there  being  a  defect  (C25)  in  a  given  clement  can  be 
obtained  from  the  "Birth  Defect  Occurrence  Rate"  which  can  be  obtained 

1 

\ 

from  service  experience  as  discussed  under  that  heading.  Tlu  outcome  j 

i 

for  a  given  element  on  a  given  airplane  in  a  given  computer  trial  can  j 
be  determined  by  Monte  Carlo  techniques  as  discussed  under  PD1. 

DD9  -  This  functional  relationship  involves  reducing  the  average  fatigue  life 
of  an  element^with  a  production  defect  by  a  constant  factor  (C26) .  Thi: 

t 

factor,  as  discussed  under  "Birth  Defect  Occurrence  Rate"  could  be  ob¬ 
tained  by  reviewing  service  experience  to  identify  the  most  prevalent 
type  of  birth  defect  and  th  n  reviewing  fatigue  test  literature  to  de¬ 
termine  what  Is  the  effect  on  fatigue  life.  It  is:  mt  tc  lp»t «.  d  that  the 
•one  factor  would  apply  to  all  elements  in  the  airplane  unK-  s  service 
experience  indicated  that  some  other  type  of  damage  v/ns  most  prevalent 
in  a  particular  type  of  structure. 


DD10  -  This  function  for  determining  whether  a  given  airplane  enters  service 
Is  a  direct  relationship  to  (X4)  the  production  number  of  the  airplane, 
<C2)  the  production  rate  and  (X5)  the  time  since  the  first  airplane 
entered  service. 

DS3  -  This  functional  relationship  is  a  simple  variable  (X12)  which  indicates 
whether  a  corrosion  defect  has  previously  occurred  in  the  element  and 
the  flight  time  on  the  airplane  when  the  defect  initiated  and  whether  it 
was  initially  internal  or  external. 

PD4  -  This  is  a  probabilistic  function  which  is  based  on  an  exponential 

probability  density  function.  As  previously  discussed,  the  Monte  Carlo 
methods  can  be  used  to  determine  whether  a  corrosion  defect  occurs  in 
the  element  on  a  given  flight.  The  rate  of  occurrence  (X13)  can  be 
obtained  from  service  experience  as  discussed  under  "Input  Data"  and  is 
anticipated  to  increase  linearily  with  time  since  first  airplane 
delivery  (X5) 

PD5  -  This  is  a  probabilistic  function  which  is  based  on  an  "either,  or" 

binomial  probability  density  function,  with  Monte  Carlo  methods  used  to 
determine  whether  corrosion  initiates  in  a  stress  concentration  given 

i 

that  corrosion  is  initiated  on  a  given  flight.  The  probability  of 
corrosion  occurring  in  a  stress  concentration  (C27)  could  be  obtained 
by  analysis  of  service  corrosion  cases  for  che  type  of  structure 
involved.  The  type  of  structure  could  be  categorized  by  me  corrosion 
resistance  rating. 


DD11  and  DD12  -  In  these  operations,  the  actual  average  fatigue  life  of  cue 

element  (X2  or  X7  as  applicable)  is  reduced  by  multiplying  factors  (C..  , 
and  (C29)  for  corrosion  in  a  stress  concentration  and  not  in  a  stress 
concentration  respectively.  This  reduction  factor  can  be  obtained  :  - 
generalized  fatigue  tests  under  corrosive  conditions.  Such  test.,  ■■■• 
indicate  that  ^  life  reduction  factor  on  the  order  of  .15  to  .25  foi 
C28  and  .50  for  C29  might  be  appropriate. 

PD6  -  This  is  the  same  type  of  functional  relationship  as  PD5  but  involves  the 
conditional,  probability  of  corrosion  initiating  in  an  external  part 
(C30)  given  that  corrosion  is  initiated  on  a  given  flight.  This  proba¬ 
bility  can  also  be  obtained  from  service  experience  for  the  type  and 
location  of  structure  involved.  If  corrosion  has  previously  occurred, 
this  outcome  was  previously  determined. 

DS4  -  In  this  operation,  the  previous  strength  reduction  of  the  section  (X14) 
due  to  this  defect  is  increased  by  the  strength  degradation  due  to 
corrosion  in  one  flight  which  is  determined  by  entering  X12  (the  time 
for  corrosion  to  initiate  in  the  element)  into  the  degradation  function 
determined  in  DD8.  The  present  strength  of  the  section  (X15)  also 
reduced  by  the  amount  corrosion  grew  in  the  flight.  X15  was  originally 

t 
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the  virgin  strength  of  the  section  td31).  it  should  be  n 
has  been  reduced  by  previous  defects  in  the  elements  and  .._i  other 
elements  in  the  section.  The  logic  diagram  assumes  that  -aly  one  corre- 
sion  defect  will  be  present  in  the  section  at  a  time. 

DS5  -  Whether  internal  corrosion  become:-  external  depends  on  whether  XI' 

exceeds  a  previous  selected  level  (C32)  which  is  based  on  the  amount  . ‘ 
material  that  must  be  eaten  away  for  corrosion  to  become  external. 

PD7  -  This  functional  relationship  is  the  same  as  PD4  except  it  applies  to 

service  damage  in  lieu  of  corrosion  and  che  race  of  occurrence  (C33)  is 
a  constant  which  can  be  obtained  from  service  experience.  The  logic 
diagram  assumes  that  the  only  affect  a  service  damage  or  production  de¬ 
fect  has  is  to  reduce  fatig  :e  life. 

DD13  -  In  this  operation,  the  actual  average  fatigue  life  of  the  element  (X2 
or  X7  as  applicable)  is  reduced  by  a  multiplying  factor  (C24)  which  can 
be  obtained  from  the  results  of  generalized  fatigue  tests  with  and  with¬ 
out  typical  service  defects. 

DS6  -  This  functional  relationship  involves  evaluating  a  simple  variable  (X15) 
which  indicates  whether  a  fatigue  crack  has  previously  occurred  in  the 
element,  the  flight  time  on  the  airplane  when  the  defect  initiated  and 
whether  th*-  uefeet  was  initially  intern. li  or  external.  Additional 
variables  ( X 1  »'>  through  Xi'i)  could  be  provided  for  the  situation  when 
multiple  fatigue  cracks  occurred  in  a  given  element. 
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DS7  -  This  function  involves  further  evaluation  of  X16  through  X19  to  deter¬ 
mine-  whether  crack"  are  internal  or  external. 

DS8  -  In  this  operation,  the  previous  strength  reductions  (X20  through  X22) 
due  to  cracks  (Xi.6  through  X19)  are  increased  to  the  crack  growth  in 
one  flight.  The  crack  growth  rate  (expressed  in  rate  of  strength 
reduction)  is  obtained  from  DD6  by  determining  whether  the  crack 
length  (X20  through  X22)  exceeds  the  critical  length  (C21)  above  which 
the  high  crack  growth  rate  applies. 

DS9  -  This  operation  is  the  same  as  DS5  except  it  is  applied  to  defects  X20 
through  X22  where  applicable. 

PD8  -  This  is  a  probabilistic  function  which  is  based  on  a  log-normal 

probability  density  functic  whose  variable  is  element  fatigue  life 
with  a  mean  equal  to  the  actual  average  fatigue  life  (X2  or  X7  is 
applicable)  and  whose  standard  deviation  (C35)  from  literature  is  on 
the  order  of  .15^-.  The  probability  of  a  classical  fatigue  crack 
occurring  on  a  given  flight  is  equal  to  the  probability  of  the  element 
having  a  fatigue  life  equal  to  the  number  of  flights  accumulated  at 
the  time  of  the  given  flight.  This  probability  can  be  obtained  from 
the  probability  density  function.  The  accumulated  uunbei  of  flights 
can  be  obtained  from  (X5)  the  time  since  first  airplane  delivery,  (>»’*' 
the  production  number  ox  the  airplane  being  evaluated,  and  (02)  the 
number  of  airplane*;  L-  jing  produced  per  unit  tine,  kith  the  a*’ove 

^Ander jjukj.  Fatigue  ‘■obec  tru  i  itton  Pr-u-r, Tiros ■ 


probability  determined  for  a  given  flight,  the  outcome  for  that  fli^/.i 
can  be  determined  by  inserting  this  probability  into  a  binomial  distri 
bution  and  evaluating  by  Monte  Carlo  techniques.  The  logic  diagram 
assumes  that  there  is  a  possibility  of  a  classical  fatigue  crack  occi 
ring  in  an  element  on  every  flight  even  though  one  has  previous!) 
occurred. 

PD9  -  This  is  the  same  type  of  functional  relationship  as  PD6  except  it  in¬ 
volves  fatigue  cracking  instead  of  corrosion  and  has  a  different 
conditional  probability  (C36). 

PD10  -  This  functional  relationship  is  the  same  as  PD4  except  it  applies  to 
non-classical  fatigue  cracks  in  lieu  of  corrosion  and  has  a  different 
rate  of  occurrence  (X23). 

DS-10  -  Tliis  operation  is  a  simple  determination  of  whether  X12,  or  X16 

through  X19  indicate  the  presence  of  a  detectable  corrosion  or  fatigue 
defect.  The  logic  diagram  does  not  provide  for  evaluation  of  the 
probability  of  structural  failure  with  no  defect  present.  Production 
defects  and  service  damage  defects  ere  assumed  to  be  initially  ur.impor 
tant  from  a  strength  reduction  standpoint. 

PD11  -  This  function  involves  a  orobabil  istie  determination  of  th** 

flight  loth  mJ  cabin  pressure  *  --.neri-.nced  by  the  iu  plane  in  a  giv.  n 
flight  ..n.-  .!  z  *  sz-n  of  <}  i  i  load  i.Ith  (X 15)  the  strength  of  the 
section  to  d-  tt  nhetoer  injure  occurs.  The  cumulative  uiscribu- 

tion  functu-n  to*'  the  probability  of  various  ma.-.irun  load  levels  can 
be  expressed  by  a  curve  for  flight  loads  and  a  curve  for  cabin 


pressure  loads.  As  discussed  under  "Rate  of  Load  Occurrence"  these 
curves  can  be  obtained  from  research  literature.  The  maximum  flight 
and  pressure  load  for  a  given  airplane  on  a  given  flight  can  be  ob¬ 
tained  by  Monte  Carlo  methods  from  the  cumulative  distribution  functl 
This  determination  would  have  to  be  made  only  once  for  each  airplu.. 
for  each  flight. 

PD12  -  This  functional  relationship  involves  the  conditional  probability  of 
the  failure  either  being  catastrophic  or  not  given  that  a  failure  o £ 
the  section  occurs.  The  conditional  probability  of  catastrophy  for 
massive  failures  of  flight  (C37)  and  pressure  structure  (C38)  can  be 
obtained  from  past  experience.  The  outcome  for  a  particular  failure 
can  be  obtained  by  Monte  Carlo  Methods  by  using  these  constants  in  a 
binomial  distribution.  These  constants  would  hold  for  all  elements. 

DS11  -  This  operation  is  a  simple  determinatif n  ot  whether  (X7)  indicates 
that  the  element  has  been  previously  modified. 

DS12  -  Whether  an  inspection  is  scheduled  or  not  is  a  direct  function  of 

whether  (X5)  the  time  since  first  airplane  delivery  is  a  multiple  of 
(C39)  the  first  level  inspection  internal  (cursory  walk  around)  and 
whether  (X24)  indicates  that  an  immediate  inspection  of  this  element 
was  specified  as  a  result  of  discovery  of  a  defect  on  the  previous 
flight. 

DS13  -  Whether  the  inspection  covers  the  defect  area  is  a  function  of  whether 
the  defect  is  now  external  or  internal  and  whether  the  level  of 
Inspection  scheduled  covers  the  element  and  the  defect  location.  The 
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level  of  inspection  scheduled  can  be  determined  from  (XI-;,  (X4)  t. 
production  number  of  the  airplane,  (X5)  time  since  flr.i  airplane 
delivery,  and  the  inspection  intervals  for  the  various  1-  vis  of  in-,.-** 
tion  in  terms  of  multiples  of  (C39)  -  (C4G,  second  level  . .  area 
inspection),  (C41,  third  level  or  close  external  inspect l a a) ,  (C  , 
fourth  level  or  internal  inspection)  and  (C42,  fourth  ;•  .el  inspO'  :  .1 

sample) . 

PS1  -  Whether  a  defect  is  found  by  the  inspection  vihich  covers  the  Jcr*.  ■.». 

area  involves  probabilistic  "either,  or"  binomial  function,  from  which 
the  outcome  for  a  given  detect  and  a  given  inspection  can  be  deter¬ 
mined  by  Monte  Carlo  methods  if  the  probability  of  detection  is  known. 
The  probability  of  detection  is  considered  to  be  a  function  of  the 
level  of  inspection,  the  type  of  defect  (fatigue  crack  or  corrosion), 
the  size  of  defect  (X14 ,  X20  through  X22)  the  general  type  structure 
(wing,  fuselage,  or  fittings),  and  whether  defect  would  involve  fuel 
leak  (C14).  It  is  anticipated,  as  discussed  under  "Inspection  Reli¬ 
ability,"  that  discrete  values  of  probability  of  detection  would  be 
obtained  through  a  survey  of  maintenance  experts  for  discrete  situatio 
defined  by  the  above  variables.  The  logic  diagram  assumes  that  produc¬ 
tion  defects  and  service  damage  are  never  found  unless  they  have 
initiated  with  fatigue  cracks  and  that  when  such  cracks  are  iousid,  they 
are  repaired  prior  to  further  t Light  with  the  repair  removing  all 
effects  of  the  production  defect  or  service  damage.  It  also  israir.es 
that  repairs  restore  element  (except  fur  other  defects  present)  to  tin. 
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original  predicted  life  ano  remove  the  strength  degradut  .  ..n  .n  the 
section  due  to  the  defect  that  was  repaired.  It  is  assumed  the  re¬ 
pairs  arc  not  fatigue  tested. 

BS14  -  Whether  a  special  immediate  fleet  inspection  of  the  given  el  crier.-  i. 
apecified  as  a  result  of  finding  a  defect  depends  on  whether 
defect  indicates  that  it  is  too  hazardous  to  depend  on  scheduled 
inspections.  A  large  defect  indicates  that  the  inspection  system  ... 
not  effective  and  a  defect  with  an  inspection  interval  large  vit  . 
caspect  to  strength  degradation  rate,  also  indicates  a  hazardous 
situation.  Consequently,  criteria  for  specifying  an  immediate  inspec¬ 
tion.  can  be  expressed  in  terms  limits  of  strength  reduction  (C44)  for 
initial  defects  and  ratio  of  inspection  interval  (lowest  effective 
level)  to  crack  growth  (C46)  or  strength  reduction  (CAS)  for  subsequent 
defects  not  found  in  special  inspections.  With  the  above  constants 
apptyi.ng  to  structure  supporting  flight  loads  additional  constants  are 
needed  for  cabin  pressure  loaded  structure  (C47),  (C48),  (CAi>).  These 
constants  would  apply  to  all  elements  in  all  airplanes  in  a  given 
simulation.  The  strength  degradation  rate  vouiu  be  based  on  (CIS), 
(CX9)  and  the  information  u-od  in  DD7  ar.d  che  inspection  interval 
would  be  the  lowest  level  of  close  inspection  of  the  defect  area. 

DDL5  -  Whether  the  frequency  of  the  lowest  level  of  close  inspection  of  the 
cLemcnt  is  increased  as  .»  result  of  finding  a  defect  depends  on 
whether  the  probability  of  detection  needs  to  be  increased  to  provide 
adequate  safety.  Such  an  increase  is  indicated  when  large  and/or 
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numerous  defects  have  been  round  In  a  given  configuration  of  the 
element  with  a  defect  is  long  with  respect  to  the  rate  of  strength 
degradation.  Consequently,  criteria  could  be  specified  as  requiring 
*n  increase  in  the  close  inspection  frequency  of  element  by  a  multi¬ 
plying  factor  (C50)  (or  some  portion  of  the  strength  degradation  ti:uO 
when: 

1.  The  strength  reduction  of  the  defect  found  exceeds  (C51),  or 

2.  The  strength  reduction  of  the  defect  found  exceeds  (C52)  und 
t&e  ratio  of  the  lowest  level  close  inspection  interval  to 
the  strength  degradation  rate  exceeds  (C53),  or 

3.  The  defect  is  found  in  a  special  immediate  inspection  and 
the  ratio  of  the  lowest  level  close  inspection  interval  to 
strength  degradation  fate  exceeds  (C53),  or 

4.  The  cumulative  scrongth  degradation  of  defects  found  (includ¬ 
ing  failures)  in  a  given  clement  (X25)  of  one  configuration 
far.  alt  airplanes  exceeds  (C54). 

The  above  constants  apply  to  structure  supporting  flight  loads,  addi¬ 
tional  constants  (C55),  (C56),  (C57)  and  (C58)  are  needed  for  cabin 

pressure  Loaded  structure.  The  inspection  program  changes  of  DD15 

* 

and  DD14  app'Ly  to  external  inspections  if  the  defect  extends  lo  exter¬ 
nal  areas,  otherwise  they  apply  fo  internal  inspections.  Some 
or  the  number  of  minimum  time  between  inspection  frequency  changes  to 
prevent  excessive  changes. 

DS16  -  Whether  a  decision  is  made  to  develop  a  retrofit  fatigue  modification 
for  delivered  airplanes  as  a  result  of  finding  a  service  fatigue 
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defect  depends  on  whether  the  cost  of  repair  per  flight  plus  the  co„i 
of  added  inspections  per  flight  exceeds  the  cost  of  modification  per 
flight..  The  cost  of  repairs  per  airplane  flight  can  be  estimated  by 
accumulating  the  cost  of  repairs  for  each  type  of  defect  (fatigue 
C&26)  or  corrosion  (X27))  and  dividing  by  the  accumulated  number  of 
flights..  The  cost  of  each  repair  could  be  estimated  from  the  weight 
or  volume  of  material  added  by  multiplying  cost  per  volume  (C59)  times 
the  length,  width  and  thickness  of  repair.  The  dimensions  of  the 
repair  would  be  a  function  of  average  thickness  of  the  element  (C60), 
the  reduction  of  strength  due  to  the  defect  (X14  or  X16  through  X19), 
whether  the  reduction  in  strength  exceeds  some  value  (C61)  which  would 
requite  complete  replacement  for  heavy  structures.  The  actual  cost  of 
repair  would  have  to  be  multiplied  by  a  downtime  factor  (C62)  and  a 
fiactor  (C63)  which  would  be  the  airline's  acknowledgement  that  defects 


may  cause  accidents.  This  later  factor  would  he  vsed  or.ly  lr.  deci  d-r.g 
whether  to  develop  a  modification  and  would  not  be  included  in  accumu¬ 
lated  repair  costs.  (C59)  could  be  initially  based  on  production 
experience  hut  should  be  normalized  so  that  simulation  of  a  typical 
situation  will  result  in  average  cost  per  repair  that  agrees  with 


service  experience. 


The.  cost  per  element  inspection  for  each  level  of  inspection  can  be 
estimated  by  dividing  the  cost  of  inspecting  the  entire  airplane  (in¬ 
cluding  down  time)  among  the  elements,  then  the  cost  for  each  level  of 
inspection  can  bo  accumulated  (X28,  first  level),  (X29,  second  level), 
(K30».  third  level),  (X31,  fourth  level)  and  (X32,  special  inspections). 


* 


The  cost  of  the  added  inspections  per  airplane  flight  can  be  deter* 
mined  by  multiplying  the  coot  p.  .r  element  inspection  (CG-V)  or  (C6i>) 

(for  the  third  or  fourth  level  inspection  involved)  time:.  (X33)  or 
(X34)  the  accumulated  inspection  frequency  increases  due  to  applies 
of  (C50)  to  third  or  fourth  level  inspections,  bividing  this  ret... 
by  the  present  inspection  interval  would  give  added  coot.,  per  nlrp  I  a  in¬ 
flight.  The  logic  diagram  assumes  that  modification  will  reduce 
inspection  frequency  to  original  values.  The  cost  of  each  tro:>l  ficuti  - 
could  be  estimated  on  the  same  basis  as  repairs  (cost  per  volume  of 
material  added).  The  volume  added  for  a  typical  case  could  be  expressed 
in  terms  of  percent  (C66)  of  material  in  the  element.  The  product  of 
(C53,  cost  per  volume)  (C60,  average  thickness)  (C67  width  of  element), 
(C62,  downtime  factor)  and  (C66)  would  give  the  cost  per  modification. 
This  value  plus  the  prorated  test  cost  divided  by  the  average  number 
of  flights  remaining  before  retirement  would  give  the  modification 
cost  per  flight.  The  average  number  of  flights  remaining  would  be  a 
function  of  (C68)  number  of  airplanes  in  the  fleet,  (C69)  the  airplane 
service  life,  modification  lead  time  (Cll  plus  one-half  of  the  inspec¬ 
tion  interval  of  the  level  of  inspection  at  which  modification  is 
incorporated^ 

The  logic  diagram  assumes  that  mod  1  i  icat  ions  -ire  not  made  for  corro¬ 
sion  deletes.  This  is  not  unreal Istlc  as  the  corrosion  detect  occur¬ 
rence  rate  ia  based  on  service  experience  which  Includes  the  crf-ct 
of  a  typical  modification  program. 


O 


0617  -  Whether  the  modification  is  available  for  incorporation  is  a  direct 
function  of  (X8)  the  time  between  first  airplane  delivery  and  the  de¬ 
cision  to  develop  the  modification,  (Cll)  the  lead  time  to  produce 
the  modification  and  the  time  since  decision  to  develop  the  modifica¬ 
tion  (function  of  X4  and  C2). 

DS18  *  Whether  the  modification  is  installed  or  not  depends  on  whether  the 

level  of  inspection  being  made  equals  or  exceeds  the  lowest  inspection 
level  at  which  modifications  are  planned  (C70)  and  whether  the  fii0  ; 
time  on  the  airplane  exceeds  the  (C71)  percentage  of  the  lowest  flight 
time  at  which  a  fatigue  defect  found  in  test  or  service  (X35). 

DS19  -  Same  as  DS1  except  it  applies  to  additional  fatigue  modification. 

DS20  •  It  is  assumed  that.no  additional  modifications  are  developed  until 
the  previous  modification  is  installed  on  all  aircraft. 

DS21,  DS22,  DS23*~  ame  as  DS16  through  DS18  except  they  apply  to  additional 
modifications 
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